Keycloak Unmanaged Attribute Modification Vulnerability for Administrators

A vulnerability exists in Keycloak that allows administrators with 'manage-users' permission to bypass the 'Only administrators can view' setting for unmanaged attributes. This flaw enables unauthorized modifications to user profiles, even when the system is configured to restrict such changes. The issue arises in Keycloak versions prior to 26.4.0.

Impact

Exploitation of this vulnerability allows for unauthorized changes to user profiles by administrators, potentially leading to misuse of user attributes or roles.

Reproduction

To reproduce this vulnerability, create a new realm and set the unmanaged attributes to 'Only administrators can view'. Then, use the Keycloak Admin Command Line Interface (kcadm.sh) to update a user attribute. The change will be applied successfully, despite the restriction, indicating that the vulnerability exists.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.4.9, which addresses this vulnerability.