A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2025:12015 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2025:12016 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2025-7784 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2381861 | Issue Tracking |
Configurations
History
11 Aug 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2025:12015 - Vendor Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2025-7784 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2381861 - Issue Tracking | |
| References | () https://access.redhat.com/errata/RHSA-2025:12016 - Vendor Advisory | |
| CPE | cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:* | |
| First Time |
Redhat
Redhat build Of Keycloak |
29 Jul 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
| CWE | ||
| References |
|
18 Jul 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-18 14:15
Updated : 2025-08-11 19:16
NVD link : CVE-2025-7784
Mitre link : CVE-2025-7784
JSON object : View
Products Affected
redhat
- build_of_keycloak
CWE
No CWE.