Group Move Vulnerability in Keycloak Services by Red Hat
CVE-2026-116468

6.6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
11 November 2026

What is CVE-2026-116468?

A security flaw has been identified in the keycloak-services component, which manages critical authentication and authorization tasks in Red Hat's Keycloak. The vulnerability arises due to the inadequate verification of administrative role assignments during group moves. This allows a delegated administrator to transfer a group under a parent group that possesses administrative roles. Consequently, the members of the moved group inherit these elevated privileges, potentially gaining complete control over the entire realm. This exploit could jeopardize user data integrity and system security if left unaddressed.

References

https://access.redhat.com/security/cve/CVE-2026-116468
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2560575
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Abhijeet Ingle for reporting this issue.
.