An administrator with limited permissions to manage identity providers in Keycloak can create a hardcoded role mapper that assigns high‑level administrative roles such as realm‑admin to themselves or others. This flaw stems from improper authorization checks during mapper creation and leads to a complete loss of control over the realm, exposing all configuration, data, and other users to the attacker.

The vulnerability affects the Red Hat Build of Keycloak; no specific version range is disclosed, so any installation of this product is potentially impacted until a vendor fix is applied.

The CVSS v3 score of 6.5 places the issue in the medium range, but the nature of the privilege escalation warrants high concern. The EPSS score is not available, so it is unclear how likely exploitation is in the wild, yet the flaw does not require external network exposure, inferring an internal or privileged‑user attack vector. The vulnerability is not listed in the CISA KEV catalogue, but the lack of a public KEV status does not mitigate the risk. Detection would involve monitoring for unauthorized mapper creation and the assignment of high‑privilege roles. Attackers could then operate with realm‑administrator authority, compromising configuration, data, and all other users.