This vulnerability in Red Hat Build of Keycloak allows a limited administrator to bypass Fine-Grained Admin Permissions (FGAP) by exploiting the POST /admin/realms/{realm}/partialImport endpoint. By importing users with realm-admin role mappings, the attacker can escalate their privileges to a full realm administrator. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory does not specify an available patch or remediation level.

Successful exploitation allows a limited administrator to escalate privileges to full realm administrator within Keycloak, potentially compromising the confidentiality, integrity, and availability of the realm's data and configurations. This could lead to unauthorized administrative control over the affected Keycloak realm.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11577 for current remediation guidance. Until an official fix is available, restrict limited administrator access to trusted personnel and monitor for suspicious use of the partialImport endpoint. Avoid granting unnecessary administrative privileges that could be leveraged to exploit this vulnerability.