CVE-2026-3121

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Published

Feb 24, 2026, 11:11:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.48% · Oct 25, 2026

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level. keycloak: org.keycloak/keycloak-services: Keycloak: Privilege escalation via manage-clients permission This issue was rated MODERATE. A privilege escalation flaw exists in Keycloak where an administrator with `manage-clients` permission can escalate privileges if "Admin Permissions" are enabled at the realm level. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.