---
id: "CVE-2026-116468"
page: "https://infrastack.ai/live/CVE-2026-116468"
kind: "vulnerability"
aliases: ["CVE-2026-116468"]
title: "Keycloak: delegated admin can move groups to gain realm-admin rights"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["keycloak", "runtime", "self-hosted", "sso"]
not_affected_if: ["no-delegated-group-admins"]
published_at: "2026-11-11T08:17:17+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:27:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116468", "first_seen_at": "2026-11-11T08:26:05+00:00"}]
exploit_sources: []
---

# Keycloak: delegated admin can move groups to gain realm-admin rights

Link for people: https://infrastack.ai/live/CVE-2026-116468 (this .md is for agents)

A delegated administrator of Keycloak can move a group they control under an administrative group, so every member of the moved group inherits full realm-admin privileges. The attacker then gets complete control over the realm.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Review realm groups and check whether any group that grants administrative roles has delegated administrators who could reparent groups
- Check the Keycloak version in use against the affected ranges in the source (unknown in the sources)

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116468

## From the sources

A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_