Moderate severity vulnerability that affects org.keycloak:keycloak-core
Moderate severity
GitHub Reviewed
Published
Oct 18, 2018
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Description
Published to the GitHub Advisory Database
Oct 18, 2018
Reviewed
Jun 16, 2020
Last updated
Jan 9, 2023
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
References