CVE-2026-94000
Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
19/09/2026
Última modificación:
22/09/2026
Descripción
*** Pendiente de traducción *** A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.
Impacto
Puntuación base 3.x
6.60
Gravedad 3.x
MEDIA