7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8hcx-p7m8-gc28

GHSA-8hcx-p7m8-gc28: Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-32h4-44jj-c5vx. This link is maintained to preserve external references.

Original Description

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-8hcx-p7m8-gc28

GHSA-8hcx-p7m8-gc28:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.6.4	26.6.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature, where an administrator with limited client management permissions could escalate their privileges. The root cause was the failure to enforce MAP_ROLE_CLIENT_SCOPE permission checks when adding or removing role scope mappings for clients or realms.

The analysis of the security patch in commit 8894c02 reveals the exact locations of the vulnerability. The patch modifies two main classes: org.keycloak.services.resources.admin.ScopeMappedClientResource and org.keycloak.services.resources.admin.ScopeMappedResource.

In both classes, the methods responsible for adding and deleting scope mappings (addClientScopeMapping, deleteClientScopeMapping, addRealmScopeMappings, deleteRealmScopeMappings) were missing a crucial permission check. The patch rectifies this by inserting the auth.roles().requireMapClientScope(roleModel); call. This call ensures that the administrator performing the action has the necessary permission to map the specific role to a client's scope.

Before the patch, an attacker with fine-grained manage permission on a single client could call these API endpoints to add highly privileged roles (like realm-admin) to that client's scope. When a user with that privileged role authenticated through the compromised client, the role would be included in their access token, leading to privilege escalation.

The identified vulnerable functions are the exact methods that were modified to include these missing security checks. During exploitation, these functions would be present in the runtime profile as they are directly responsible for processing the malicious scope mapping request.

Vulnerable functions

org.keycloak.services.resources.admin.ScopeMappedClientResource.addClientScopeMapping

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java

This function was missing a permission check to verify if the administrator has the `MAP_ROLE_CLIENT_SCOPE` permission for the role being added to the client's scope mapping. This allowed a low-privileged admin to add highly privileged roles.

org.keycloak.services.resources.admin.ScopeMappedClientResource.deleteClientScopeMapping

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java

This function was missing a permission check to verify if the administrator has the `MAP_ROLE_CLIENT_SCOPE` permission for the role being removed from the client's scope mapping. The patch also adds a filter `.filter(auth.roles()::canMapClientScope)` when deleting all roles.

org.keycloak.services.resources.admin.ScopeMappedResource.addRealmScopeMappings

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java

This function was missing a permission check to verify if the administrator has the `MAP_ROLE_CLIENT_SCOPE` permission for the role being added to the realm's scope mapping. This allowed a low-privileged admin to add highly privileged roles.

org.keycloak.services.resources.admin.ScopeMappedResource.deleteRealmScopeMappings

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java

This function was missing a permission check to verify if the administrator has the `MAP_ROLE_CLIENT_SCOPE` permission for the role being removed from the realm's scope mapping. The patch also adds a filter `.filter(auth.roles()::canMapClientScope)` when deleting all roles.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.