# OpenRemote has Improper Access Control via updateUserRealmRoles function

OpenRemote Manager's updateUserRealmRoles trusts the {realm} path segment, letting a write:admin user in one Keycloak realm grant admin roles to users in master.

- Payout: Research
- Severity: high
- Program: OpenRemote
- Found by: KKC73
- Disclosed: 2026-04-22
- CVE: CVE-2026-41166
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-49vv-25qx-mg44
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-49vv-25qx-mg44
- Tags: area:web domain:api domain:web impact:ato impact:privesc kind:research platform:ghsa sev:high tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Manager REST API endpoint /api/{realm}/user/{realm}/userRealmRoles/{userId} backed by Keycloak
**Root cause:** UserResourceImpl.updateUserRealmRoles passes the caller-supplied {realm} path segment straight to the identity provider without verifying the caller is authorized to administer that realm.
**Steps:**
1. Create a new Keycloak realm (NEW_REALM) with a user granted the OpenRemote client role `write:admin`.
2. In realm `master`, pick a low-privilege user and copy its UUID (`<master-user-uuid>`).
3. Authenticate as the NEW_REALM user to get a Bearer token (`<token>`).
4. Send `curl -k -X PUT "https://<host>/api/<NEW_REALM>/user/master/userRealmRoles/<master-user-uuid>" -H "Authorization: Bearer <token>" -H "Content-Type: application/json" -d '["admin"]'`.
5. Confirm in Keycloak Admin Console (master realm, user, Role mapping) that the `admin` realm role is assigned.
**How found:** Code review of UserResourceImpl.updateUserRealmRoles revealed the {realm} path parameter is forwarded to the identity provider with no authorization check on realm administration.
**Exploitation:** Attacker with write:admin in any realm authenticates, then calls the endpoint with {realm}=master and a target master user UUID, assigning the `admin` realm role to that user; if the attacker controls that user, they gain Keycloak master realm administrator access.
**Escalation:** Cross-realm pivot from a low-trust realm's write:admin to master realm administrator by targeting a user the attacker controls in master.
**Insight:** In multi-tenant IdP-backed APIs, the tenant/realm identifier in the URL is often trusted implicitly; test whether a token valid in realm A can drive operations against realm B, especially the master/admin realm.

## Proof of concept (copied exactly from the original report)

**curl PUT granting master realm admin role cross-realm**

```
curl -k -X PUT "https://<host>/api/<NEW_REALM>/user/master/userRealmRoles/<master-user-uuid>" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '["admin"]'
```