CVE-2026-3121

Katalog CVE

CVSS 7.2 · High EPSS 0,53%

Kerentanan Incorrect Privilege Assignment pada redhat build of keycloak, redhat jboss enterprise application platform +2 lainnya. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-3121 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2442277 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:6477
• https://access.redhat.com/errata/RHSA-2026:6478