A vulnerability in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak allows an administrator with limited rights to assign a role that includes full administrative control due to improper permission checks on composite roles. This flaw enables privilege escalation to complete management access over the entire realm.