The vulnerability in Red Hat Build of Keycloak's Admin REST API occurs because the system does not verify whether a group grants administrative privileges before permitting a user to be added to it. This flaw enables a delegated administrator who has limited permissions to escalate their privileges by adding themselves to a high-privilege group, thereby gaining full control over the entire realm. The issue specifically affects the group-membership endpoints and stems from a failure to validate the administrative implications of group membership changes. Red Hat rates the severity as Moderate due to the prerequisite conditions for exploitation, including possession of high-level delegated administrative privileges and a particular group mapping configuration.

Successful exploitation allows an attacker with existing high-level delegated administrative privileges to escalate to realm-admin privileges, gaining full control over the affected realm. This includes the ability to read and modify sensitive data, bypass protection mechanisms, and potentially cause denial of service through resource consumption. The vulnerability impacts confidentiality, integrity, access control, and availability within the affected Keycloak realm.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires specific preconditions, organizations should review their administrative group configurations and limit delegated administrative privileges where possible. Customers with a Technical Account Manager (TAM) can consult directly for tailored guidance.