This vulnerability in Red Hat Build of Keycloak allows an authenticated administrator with the manage-clients role to exploit a TOCTOU race condition in name-based admin role checks. By doing so, the attacker can escalate their privileges to realm-admin for all users within the realm, gaining extensive control over the system. The composite role relationship created by the exploit persists beyond revocation of the attacker's permissions and survives system reboots. The flaw affects the integrity of role-based access control and is classified as a moderate privilege escalation issue. No official fix or patch is currently available that meets Red Hat's criteria for deployment and stability.

The vulnerability allows an attacker with manage-clients privileges to escalate to realm-admin privileges, granting extensive control over all users in the realm. This compromises the integrity of the system's role-based access control. The elevated privileges persist even after the attacker's original permissions are revoked and survive system reboots, potentially allowing long-term unauthorized access and control. There is no impact on availability reported. Confidentiality and integrity impacts are high.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's advisory for updates. Until a fix is released, limiting the assignment of the manage-clients role to trusted administrators and auditing role assignments may reduce risk. Customers with a Red Hat Technical Account Manager (TAM) can review this CVE directly with their TAM for tailored guidance.