← Volver a CVEs
CVE-2026-3121
MEDIUM6.5
Descripcion
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.
Detalles CVE
Puntuacion CVSS v3.16.5
SeveridadMEDIUM
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosHIGH
Interaccion usuarioNONE
Publicado3/26/2026
Ultima modificacion4/2/2026
Fuentenvd
Avistamientos honeypot0
Productos afectados
redhat:build_of_keycloakredhat:jboss_enterprise_application_platformredhat:jboss_enterprise_application_platform_expansion_packredhat:single_sign-on
Debilidades (CWE)
CWE-266
Referencias
https://access.redhat.com/errata/RHSA-2026:6477(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:6478(secalert@redhat.com)
https://access.redhat.com/security/cve/CVE-2026-3121(secalert@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2442277(secalert@redhat.com)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.