A flaw in Red Hat Build of Keycloak allows a user with manage-clients permission to inject a hardcoded role mapper into a client. This injection bypasses existing scope restrictions and injects the realm-admin role into tokens, granting full administrative access to the realm. The vulnerability lies in improper authorization controls (CWE-266). The impact is the ability of an attacker with sufficient permissions to gain unrestricted administrative privileges within the affected realm, potentially compromising all data and services under that realm.

The vulnerability affects Red Hat Build of Keycloak. No specific version numbers are listed in the advisory. The flaw can affect any deployment of this product where the manage-clients permission is assigned to users or roles that are not strictly necessary.

The CVSS score is 6.5, indicating a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to possess a user or role with the manage-clients permission within the same realm. An attacker who can act as such a privileged user can modify client configuration and inject the role mapper, achieving privilege escalation to realm-admin. Because the prerequisite is a privileged role, the vulnerability is less likely to be exploited remotely, but it poses a significant risk to internal users who may have been granted excessive permissions.