This vulnerability arises from a missing authorization check in the user creation API payload of Keycloak when FGAP V2 is enabled. A sub-administrator who can create users can bypass group membership restrictions and add users to unauthorized groups. This flaw could allow unauthorized access to sensitive data and elevated privileges for the newly created users. The issue is specific to Red Hat's build of Keycloak and requires FGAP V2 to be enabled, which is not the default configuration. Red Hat has assessed the severity as moderate and has not yet provided an official patch or mitigation that meets their standards for ease of use, applicability, and stability.

Successful exploitation allows a sub-administrator with user creation rights to bypass group membership restrictions, potentially leading to unauthorized access to sensitive information and privilege escalation for new users. The vulnerability impacts confidentiality, integrity, and availability by enabling unauthorized read and modification of application data and possible denial of service through resource consumption. However, exploitation requires existing high-level sub-administrator privileges and the non-default FGAP V2 feature enabled.

Currently, no mitigation or patch meeting Red Hat's criteria for ease of use, applicability, and stability is available. Users should monitor the Red Hat advisory page for updates. Since exploitation requires FGAP V2 to be enabled and high-level sub-administrator privileges, limiting the use of FGAP V2 or restricting sub-administrator permissions may reduce risk until an official fix is released.