What is GHSA-p5q4-94mg-325p?

GHSA-p5q4-94mg-325p is a security advisory published by GitHub Security Advisories with High severity. A flaw was found in Keycloak. A limited administrator can exploit an improper access control...

Which CVE IDs does GHSA-p5q4-94mg-325p cover?

GHSA-p5q4-94mg-325p covers the following CVE IDs: CVE-2026-11577. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p5q4-94mg-325p?

GHSA-p5q4-94mg-325p has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-p5q4-94mg-325pHighCVSS 7.2

A flaw was found in Keycloak. A limited administrator can exploit an improper access control...

Vendor

GitHub Security Advisories

Published

June 8, 2026

Last Modified

June 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-11577 →

📋 Description

A flaw was found in Keycloak. A limited administrator can exploit an improper access control vulnerability in the POST /admin/realms/{realm}/partialImport endpoint. This allows them to bypass Fine-Grained Admin Permissions (FGAP) and escalate their privileges to a full realm administrator by importing users with realm-admin role mappings.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-11577
https://github.com/keycloak/keycloak/issues/9387
https://access.redhat.com/security/cve/CVE-2026-11577
https://bugzilla.redhat.com/show_bug.cgi?id=2459993
https://github.com/advisories/GHSA-p5q4-94mg-325p