CVE-2026-11577: high vulnerability (CVSS 7.2)
CVE-2026-11577 impacts Keycloak, enabling limited admins to exploit improper access controls via the partialImport endpoint. This bypasses Fine-Grained Admin Permissions, allowing privilege escalation to full realm administrator by importing users with elevated role mappings.
Mitigate by restricting access to the partialImport endpoint and auditing user role mappings. Prioritize patching systems to prevent exploitation and ensure FGAP enforcement for sensitive operations.
Keycloak's POST /admin/realms/{realm}/partialImport endpoint suffers from an improper access control vulnerability. Limited administrators can bypass Fine-Grained Admin Permissions to escalate their privileges.
Attackers exploit this flaw by importing users with realm-admin role mappings, effectively gaining full realm administrator access. This can lead to unauthorized actions across the affected realm.
Administrators should patch Keycloak to address CVE-2026-11577 and implement strict endpoint access controls. Regular audits of admin permissions can further reduce the risk of exploitation.