CVE-2026-9795 Details

A privilege escalation vulnerability exists in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management rights can exploit this flaw to assign any realm role, including highly privileged ones, to a client's scope mapping. This action bypasses established security controls, allowing the assigned role to be included in a user's authentication token when they access the altered client. Consequently, this could result in unauthorized privilege escalation within the Keycloak realm.

To address this vulnerability, disable the Fine-Grained Admin Permissions (FGAPv2) feature in Keycloak, unless it is absolutely necessary. This can usually be done by setting 'adminPermissionsEnabled' to 'false' in the realm configuration. After making this change, a restart or reload of the Keycloak service may be required for the changes to take effect.