An improper access control flaw was discovered in the POST /admin/realms/{realm}/partialImport endpoint. A user with a limited administrator role can exploit this by importing users that are granted realm‑admin role mappings, thereby bypassing the Fine‑Grained Admin Permissions (FGAP) and attaining full realm‑administrator privileges. This is a classic missing access‑control weakness (CWE‑863) that directly compromises a realm’s security.

Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7 are the affected products. Specific version information is not provided in the advisory, so any installation using these products with the vulnerable endpoint exposed remains at risk.

The vulnerability carries a CVSS score of 7.2, which indicates medium severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, so the probability of exploitation is currently unclear. The likely attack vector is a properly authenticated POST request to the partialImport endpoint, meaning the threat is limited to environments where the admin interface is reachable and the user has limited admin rights. Until a vendor fix is issued, the risk is moderate but could increase if the flaw becomes publicly exploited or if configuration changes expose the endpoint to broader networks.