~ / search / GHSA-6q37-7866-h27j

GHSA-6q37-7866-h27j

Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

Source: GitHub Advisory Database (reviewed) Low CVE-2025-14082

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.5.0 26.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.

References

External links from the advisory. They lead to third-party sites.