{"id":"CVE-2026-96448","aliases":[],"cve":{"records":[{"id":"CVE-2026-96448","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-23T09:42:55.806Z","published":"2026-09-25T07:39:51.903Z","modified":"2026-11-06T10:27:24.945Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T10:27:24.945Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-26T22:51:18.996Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:95761","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96448","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539291","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-285","description":"Improper Authorization","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-26T22:42:06.218227Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.","score":6.6,"severity":"medium","published":"2026-09-25T07:39:51.903Z","modified":"2026-11-06T10:27:24.945Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6.8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96448"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6.8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96448"},{"vendor":"Red Hat","name":"Red Hat Single Sign-On 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96448"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96448"}],"references":["https://access.redhat.com/errata/RHSA-2026:95761","https://access.redhat.com/security/cve/CVE-2026-96448","https://bugzilla.redhat.com/show_bug.cgi?id=2539291"],"sources":[{"name":"CVE","id":"CVE-2026-96448","modified":"2026-11-06T10:27:24.945Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96448"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","score":6.6}],"sourceAffected":[],"observedAt":"2026-11-06T10:51:48.192Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T13:20:34.891Z","attemptedAt":"2026-11-06T13:20:34.891Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T13:20:35.049Z","attemptedAt":"2026-11-06T13:20:35.049Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T13:20:35.551Z","attemptedAt":"2026-11-06T13:20:35.551Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T13:20:35.456Z","attemptedAt":"2026-11-06T13:20:35.456Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-96448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96448","modified":"2026-11-06T11:17:22.887","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T13:20:34.891Z"},{"source":"GitHub Advisory Database","id":"GHSA-x6m6-7qg7-7r64","url":"https://github.com/advisories/GHSA-x6m6-7qg7-7r64","modified":"2026-11-06T12:31:35Z","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T13:20:35.049Z"},{"source":"FIRST EPSS","id":"CVE-2026-96448","url":"https://www.first.org/epss/","probability":0.00237,"percentile":0.14803,"date":"2026-11-05","checkedAt":"2026-11-06T13:20:35.456Z"},{"source":"ENISA EUVD","id":"EUVD-2026-86588","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-86588","modified":"Nov 6, 2026, 10:27:24 AM","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T13:20:35.551Z"}],"aiSummary":{"text":"A flaw in Keycloak's Fine-Grained Admin Permissions (FGAP v2) feature allows an administrator with limited rights to assign a role that includes full administrative control. The issue occurs when the system checks role assignments without looking inside composite roles. This may allow an attacker to gain complete management access.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T11:01:08.781Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96448"}]}}