CVE-2026-96448

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak. The issue occurs during the verification process of whether a delegated administrator has the necessary permissions to assign a specific role to a user. Because the system fails to inspect composite roles—roles that are composed of other roles—to identify the permissions they contain, an administrator with restricted privileges can assign a composite role that includes full administrative control. This allows an attacker to obtain complete management access over the entire realm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.