Moderate severity vulnerability that affects org.keycloak:keycloak-core

published 2018-03-12 8 y ago modified 2026-06-17 4 mo ago also GHSA-778x-2mqv-w6xw , EUVD-2018-0534

cvss: 6.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

Patch / fix

fixed in 2 distros 1

maven org.keycloak:keycloak-core 2.4.0
redhat keycloak 2.4.0

rh-sso7 red hat single sign on 7 1-2.jbcs.el6
rh-sso7-zxing red hat single sign on 7 3.2.1-1.redhat_4.1.jbcs.el6
rh-sso7-runtime red hat single sign on 7 1-2.jbcs.el6
rh-sso7-keycloak red hat single sign on 7 2.5.5-2.Final_redhat_1.1.jbcs.el6
rh-sso7-liquibase red hat single sign on 7 3.4.1-2.redhat_2.1.jbcs.el6
rh-sso7-twitter4j red hat single sign on 7 4.0.4-1.redhat_3.1.jbcs.el6
rh-sso7-freemarker red hat single sign on 7 2.3.23-1.redhat_2.2.jbcs.el6
rh-sso7-zxing-core red hat single sign on 7 3.2.1-1.redhat_4.1.jbcs.el6

red hat advisories RHSA-2017:0872 RHSA-2017:0873

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-8629 updated 2025-11-21 cvss 4.3

keycloak: user deletion via incorrect permissions check

Red Hat Single Sign-On 7.1
fixed: vendor fix RHSA-2017:0876
Red Hat Single Sign-On 7.1 for RHEL 6 Server rh-sso7 1-2.jbcs.el6, rh-sso7-runtime 1-2.jbcs.el6, rh-sso7-zxing 3.2.1-1.redhat_4.1.jbcs.el6, rh-sso7-libunix-dbus-java 0.8.0-2.jbcs.el6, rh-sso7-liquibase 3.4.1-2.redhat_2.1.jbcs.el6, rh-sso7-twitter4j 4.0.4-1.redhat_3.1.jbcs.el6, +9 more
fixed: vendor fix RHSA-2017:0872
Red Hat Single Sign-On 7.1 for RHEL 7 Server rh-sso7 1-2.jbcs.el7, rh-sso7-runtime 1-2.jbcs.el7, rh-sso7-zxing 3.2.1-1.redhat_4.1.jbcs.el7, rh-sso7-libunix-dbus-java 0.8.0-2.jbcs.el7, rh-sso7-liquibase 3.4.1-2.redhat_2.1.jbcs.el7, rh-sso7-twitter4j 4.0.4-1.redhat_3.1.jbcs.el7, +9 more
fixed: vendor fix RHSA-2017:0873

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.90% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	5.5	AV:N/AC:L/Au:S/C:N/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
maven	org.keycloak:keycloak-core	<2.4.0	2.4.0

Affected products

Red Hat, Inc. Keycloak

Classification

Weakness

CWE-284 Improper Access Control
CWE-264 Permissions, Privileges, and Access Controls

References

rhn.redhat.com /errata/RHSA-2017-0876.html
vendor-advisory, web, third-party-advisory
access.redhat.com /errata/RHSA-2017:0873
vendor-advisory, web
access.redhat.com /errata/RHSA-2017:0872
vendor-advisory, web
securitytracker.com /id/1038180
vdb-entry, web, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1388988
web, issue-tracking
securityfocus.com /bid/97392
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2016-8629
advisory
github.com /advisories/GHSA-778x-2mqv-w6xw
advisory

Sources

CVE List CVE-2016-8629
GitHub Advisory GHSA-778x-2mqv-w6xw
NVD CVE-2016-8629

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary