The vulnerability in Red Hat Build of Keycloak's FGAP v2 arises because the authorization check for delegated administrators assigning roles does not recursively verify permissions inside composite roles. As a result, an attacker with limited administrative rights can assign a composite role that implicitly grants full administrative privileges, leading to complete management control over the realm. The root cause is a failure to perform recursive authorization checks during role mapping. Red Hat rates the severity as Important and assigns a CVSS v3.1 score of 6.6, reflecting network attack vector, high attack complexity, and high privileges required. The vulnerability impacts confidentiality, integrity, and availability by enabling privilege escalation and unauthorized administrative actions. No patch or effective mitigation is currently available according to the Red Hat advisory.

Successful exploitation allows an attacker with delegated administrative rights to escalate privileges to full realm-admin, gaining complete control over the realm. This includes the ability to read, modify, and delete sensitive data and configurations within the realm. The vulnerability affects confidentiality, integrity, and availability of the system. Exploitation requires a specific configuration where composite roles with privileged permissions exist, and the attacker has some delegated administrative access.

Currently, no mitigation or patch meeting Red Hat's standards for ease of use, applicability, or stability is available. Users should monitor Red Hat advisories for updates. Until a fix is released, organizations should carefully review and restrict delegated administrator permissions and composite role configurations to minimize exposure. Engage with Red Hat Technical Account Managers if available for tailored guidance.