CVE-2026-97177 — Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password re…
Published: 2026-09-24 · CVSS: 6.6 · CVSS 3.1
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7