A missing authorization check in the user update REST API endpoint of Red Hat Build of Keycloak allows delegated administrators, who should be restricted from resetting passwords, to bypass explicit permission denials and reset user passwords. This enables account takeover by modifying user credentials. The vulnerability requires Fine-Grained Admin Permissions to be enabled and attacker possession of delegated administrator privileges. Red Hat has assessed the severity as moderate (CVSS 6.6) and currently has no suitable mitigation or patch available that meets their standards for ease of use, applicability, and stability.

Successful exploitation allows an attacker with delegated administrator privileges to bypass password reset restrictions and take over user accounts by changing credentials. This impacts confidentiality, integrity, and availability by enabling unauthorized access, modification of sensitive data, and potential denial of service through resource misuse. The vulnerability requires network access and high privileges but no user interaction.

Red Hat currently does not provide an official patch or mitigation that meets their criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires delegated admin privileges and Fine-Grained Admin Permissions enabled, limiting these configurations and privileges may reduce risk until a fix is available.