A vulnerability in the group-move and organization group reparenting endpoints of the keycloak-services component in the Red Hat build of Keycloak allows delegated administrators to escalate privileges. The flaw arises because the system does not verify if the target parent group confers administrative roles when a group is moved. Exploiting this, an attacker can move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm. The issue is a missing authorization check and represents an incomplete fix for a previous vulnerability (CVE-2026-94000).