Product
Keycloak versions up to 26.8.1 are vulnerable to privilege escalation where a user with "manage-users" permissions can assign composite roles containing "realm-admin" privileges due to incomplete authorization checks.