CVE-2025-7784: Keycloak Privilege Escalation Vulnerability

CVE-2025-7784 Overview

CVE-2025-7784 is a privilege escalation vulnerability in the Red Hat Build of Keycloak identity and access management system. The flaw exists when Fine-Grained Admin Permissions v2 (FGAPv2) are enabled. An administrative user holding the manage-users role can escalate privileges to realm-admin due to improper privilege enforcement. This breaks the intended separation of administrative duties within a realm and grants unauthorized access to realm-wide administrative functionality. Red Hat published advisories RHSA-2025:12015 and RHSA-2025:12016 to address the issue, tracked under CWE-269 (Improper Privilege Management).

Critical Impact
A low-tier admin with manage-users can obtain full realm-admin control, compromising tenant isolation and administrative segregation in Keycloak realms.

Affected Products

Red Hat Build of Keycloak (versions with FGAPv2 enabled)
Deployments configured with Fine-Grained Admin Permissions v2
Keycloak realms delegating scoped administrative roles

Discovery Timeline

2025-07-18 - CVE-2025-7784 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7784

Vulnerability Analysis

The vulnerability resides in the Fine-Grained Admin Permissions v2 authorization layer of Keycloak. FGAPv2 allows administrators to delegate narrowly scoped management responsibilities, such as user administration, without granting realm-wide control. The manage-users role is intended to permit account lifecycle operations only.

Due to improper privilege enforcement, an actor with manage-users can perform actions that effectively grant realm-admin. This collapses the boundary between scoped delegation and full realm administration. Attack complexity is low and no user interaction is required, but high privileges (an existing admin account with manage-users) are needed to exploit the issue.

The consequence is a vertical privilege escalation within a realm. An attacker gaining realm-admin can manage clients, identity providers, roles, and authentication flows, effectively taking control of every identity governed by that realm.

Root Cause

The root cause is classified under CWE-269: Improper Privilege Management. The FGAPv2 authorization checks do not adequately validate that operations invoked by a manage-users role holder remain within the intended scope. Specific administrative endpoints permit role or permission changes that should require realm-admin, allowing the caller to promote themselves or grant equivalent capabilities.

Attack Vector

Exploitation requires an authenticated administrative account already assigned the manage-users role in a realm where FGAPv2 is enabled. The attacker interacts with the Keycloak Admin REST API over the network to invoke user or role management operations that improperly bypass privilege checks. Once escalated, the account can modify authentication configuration, add federation providers, or issue tokens for any user in the realm.

No verified public exploit is available. Refer to the Keycloak GitHub Issue #39956 and Red Hat Bug Report #2381861 for maintainer discussion of the flaw.

Detection Methods for CVE-2025-7784

Indicators of Compromise

Unexpected assignment of the realm-admin composite role to accounts that previously held only manage-users.
Admin event log entries showing role mapping changes, client creation, or identity provider modifications originating from non-realm-admin accounts.
New service accounts or clients created shortly after manage-users API activity.
Modifications to authentication flows or credential resets across many users by a single admin actor.

Detection Strategies

Enable Keycloak admin event logging and forward events to a SIEM for correlation of role assignment and permission changes.
Alert on any operation that grants realm-admin, manage-realm, or manage-clients roles when the initiating principal is not a pre-approved realm administrator.
Baseline the set of accounts holding elevated realm roles and detect drift.

Monitoring Recommendations

Continuously monitor /admin/realms/{realm}/users/{id}/role-mappings and /admin/realms/{realm}/roles endpoints for anomalous calls.
Track token issuance patterns for admin service accounts and flag sudden expansion of scope.
Review FGAPv2 permission policies periodically for unintended grants or overly broad resource scopes.

How to Mitigate CVE-2025-7784

Immediate Actions Required

Apply the fixes published in Red Hat Security Advisory RHSA-2025:12015 and RHSA-2025:12016.
Audit all realm accounts currently holding the manage-users role and validate that no unauthorized privilege escalation has occurred.
Rotate credentials and session tokens for any account suspected of exploiting the flaw.

Patch Information

Red Hat has released patched builds of Keycloak referenced in the vendor advisories. Consult the Red Hat Security Info for CVE-2025-7784 for exact package versions and errata mapping to your deployment. Upgrade to the fixed Red Hat Build of Keycloak release addressing the FGAPv2 authorization bypass.

Workarounds

Disable Fine-Grained Admin Permissions v2 if not required for the deployment and revert to standard realm admin role assignments.
Restrict the manage-users role to a minimum set of trusted operators and monitor their activity closely.
Segment high-value realms and require multi-party approval for role mapping changes through external workflow tooling.

bash

# Review realm users holding manage-users and verify no realm-admin drift
kcadm.sh config credentials --server https://keycloak.example.com \
    --realm master --user admin

kcadm.sh get users -r <realm> -q briefRepresentation=true
kcadm.sh get-roles -r <realm> --uusername <user> --effective