{"id":"CVE-2026-116468","kind":"vulnerability","aliases":["CVE-2026-116468"],"related":[],"title":"Keycloak: delegated admin can move groups to gain realm-admin rights","description":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.","summary":"A delegated administrator of Keycloak can move a group they control under an administrative group, so every member of the moved group inherits full realm-admin privileges. The attacker then gets complete control over the realm.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["keycloak","runtime","self-hosted","sso"],"not_affected_if":["no-delegated-group-admins"],"how_to_check":"- Review realm groups and check whether any group that grants administrative roles has delegated administrators who could reparent groups\n- Check the Keycloak version in use against the affected ranges in the source (unknown in the sources)","fix":null,"status":"open","published_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:55+00:00","updated_at":"2026-11-11T08:27:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T08:27:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: delegated admin can move groups to gain realm-admin rights","impact":"high","summary":"A delegated administrator of Keycloak can move a group they control under an administrative group, so every member of the moved group inherits full realm-admin privileges. The attacker then gets complete control over the realm.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","self-hosted","sso"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"delegated admin gains full realm-admin control over the realm","analyst_note":"Confirm affected and fixed Keycloak versions and whether delegated group-management permissions are required, using the NVD entry and Red Hat advisory.","how_to_check":"- Review realm groups and check whether any group that grants administrative roles has delegated administrators who could reparent groups\n- Check the Keycloak version in use against the affected ranges in the source (unknown in the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-delegated-group-admins"],"who_is_affected":"Organizations running Red Hat build of Keycloak or Keycloak where delegated administrators can manage groups or organization group hierarchies. Realms that do not delegate group management to non-full admins are less exposed. The sources do not name affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4598,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116468':15A,18A '-2026':14A,17A 'admin':3A,11A,51B,145C 'administr':27B,38B,114C,123C,135C 'attack':54B 'authent':88C 'author':90C 'build':96C 'caus':137C 'check':107C 'complet':57B,149C 'compon':81C,83C 'confer':113C 'control':35B,58B,132C,150C 'core':87C 'cve':13A,16A 'deleg':2A,26B,122C 'endpoint':75C 'everi':41B 'exploit':125C 'fail':105C 'flaw':63C 'found':65C 'full':48B,142C 'gain':8A,148C 'get':56B 'group':6A,33B,39B,46B,69C,73C,112C,118C,130C,136C 'group-mov':68C 'hat':95C 'host':23B 'inherit':47B,141C 'issu':100C 'keycloak':1A,19B,29B,79C,98C 'keycloak-servic':78C 'member':42B,139C 'move':5A,31B,45B,70C,120C,128C 'occur':101C 'organ':72C 'parent':111C 'privileg':52B,146C 'realm':10A,50B,61B,144C,153C 'realm-admin':9A,49B,143C 'red':94C 'repar':74C 'respons':85C 'right':12A 'role':115C 'runtim':20B 'self':22B 'self-host':21B 'servic':80C,91C 'sso':24B 'system':104C 'target':110C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Red Hat build of Keycloak or Keycloak where delegated administrators can manage groups or organization group hierarchies. Realms that do not delegate group management to non-full admins are less exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["keycloak","medium","runtime","selfhosted","sso"],"campaign_type":null,"search_a":"'-116468':15A,18A '-2026':14A,17A 'admin':3A,11A 'cve':13A,16A 'deleg':2A 'gain':8A 'group':6A 'keycloak':1A 'move':5A 'realm':10A 'realm-admin':9A 'right':12A","search_b":"'admin':51B 'administr':27B,38B 'attack':54B 'complet':57B 'control':35B,58B 'deleg':26B 'everi':41B 'full':48B 'get':56B 'group':33B,39B,46B 'host':23B 'inherit':47B 'keycloak':19B,29B 'member':42B 'move':31B,45B 'privileg':52B 'realm':50B,61B 'realm-admin':49B 'runtim':20B 'self':22B 'self-host':21B 'sso':24B","search_c":"'admin':145C 'administr':114C,123C,135C 'authent':88C 'author':90C 'build':96C 'caus':137C 'check':107C 'complet':149C 'compon':81C,83C 'confer':113C 'control':132C,150C 'core':87C 'deleg':122C 'endpoint':75C 'exploit':125C 'fail':105C 'flaw':63C 'found':65C 'full':142C 'gain':148C 'group':69C,73C,112C,118C,130C,136C 'group-mov':68C 'hat':95C 'inherit':141C 'issu':100C 'keycloak':79C,98C 'keycloak-servic':78C 'member':139C 'move':70C,120C,128C 'occur':101C 'organ':72C 'parent':111C 'privileg':146C 'realm':144C,153C 'realm-admin':143C 'red':94C 'repar':74C 'respons':85C 'role':115C 'servic':80C,91C 'system':104C 'target':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116468","severity":null,"published_at":"2026-11-11T08:17:17+00:00","modified_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}