CVE-2025-7784

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
—	—	< 26.2.6
Red Hat	Red Hat build of Keycloak 26	—
Red Hat	Red Hat build of Keycloak 26.2	—
Red Hat	Red Hat build of Keycloak 26.2	—
Red Hat	Red Hat build of Keycloak 26.2	—
Red Hat	Red Hat JBoss Enterprise Application Platform 8	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—
Red Hat	Red Hat Single Sign-On 7	—

References

https://access.redhat.com/errata/RHSA-2025:12015Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:12016Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-7784Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2381861Issue Tracking
https://github.com/keycloak/keycloak/issues/39956

Timeline

Published: Jul 18, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-77854.3A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the fil CVE-2025-77865.4A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing CVE-2025-77878.8A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the CVE-2025-77888.8A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function com CVE-2025-77893.7A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of CVE-2025-77906.5A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. This affects an unknown part of the file /menu_n CVE-2025-77915.4A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been declared as problematic. This vulnerability af CVE-2025-77928.8A vulnerability was found in Tenda FH451 1.0.0.9. It has been rated as critical. This issue affects the function formSafeEmailFilter of the CVE-2025-77938.8A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function formWebTypeLibrary of the file /gofor CVE-2025-77948.8A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatStaticSetting CVE-2025-77958.8A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. Affected by this issue is the function fromP2pList CVE-2025-77968.8A vulnerability, which was classified as critical, was found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserAdd of the file /