CVE-2026-11577: Keycloak: keycloak: privilege escalation via partialimport fgap permission bypass

Synopsis

A privilege escalation vulnerability exists in Keycloak's partialImport endpoint (POST /admin/realms/{realm}/partialImport). An authenticated limited administrator can bypass Fine-Grained Admin Permissions (FGAP) by importing users with realm-admin role mappings, effectively granting themselves full realm administrator rights. The flaw is reachable over the network and requires no victim interaction. No fix versions have been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The partialImport endpoint is exposed over the network, so the attacker must be able to reach the Keycloak admin API via HTTP/S.

• AuthenticationRequired

  The attacker must hold a valid limited-administrator account; any low-privilege admin credential is sufficient to trigger the bypass.

• Victim interactionNot required

  No victim action is needed; the attacker sends the crafted import request directly without involving another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions or special environmental factors are required to reach the vulnerable code path.

Blast Radius

• A successful attacker promotes their account to full realm administrator, gaining unrestricted control over the Keycloak realm configuration.
• The attacker can read all realm data, including stored user credentials, session tokens, and identity provider secrets.
• The attacker can modify any realm object: adding or removing users, altering role assignments, and changing authentication flows.
• With full realm-admin rights the attacker can disable or misconfigure authentication policies, effectively locking out legitimate administrators or disrupting SSO-dependent services.