A vulnerability in the Admin REST API of Keycloak allows a delegated administrator with limited permissions to add themselves to a high-privilege group without proper authorization checks. This flaw exists in the group-membership endpoints where the system fails to verify if a group grants administrative privileges before permitting user additions. Exploiting this issue could lead to privilege escalation, granting full control over the entire realm.