CVE-2026-3121
Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission
- State
- Published
- Severity
- 6.5 Medium
- Published
- Mar 26, 2026
- Updated
- Apr 2, 2026
- Reserved
- Feb 24, 2026
Description
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | redhat |
Weaknesses
- CWE-266 Incorrect Privilege Assignment
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.11Red Hat | |
Red Hat JBoss Enterprise Application Platform 8Red Hat | |
Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat | |
Red Hat Single Sign-On 7Red Hat |
References
- RHSA-2026:6477vendor-advisory
- RHSA-2026:6478vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-3121vdb-entry
- RHBZ#2442277issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.