OpenRemote IoT platform prior to version 1.22.1 contains a privilege escalation vulnerability in its Keycloak integration. A user with write:admin permissions in one Keycloak realm can exploit the Manager API to update realm roles for users in other realms, including the master realm. The vulnerability exists because the handler uses the realm path segment when communicating with the identity provider but fails to verify that the caller has administrative rights for that realm. This flaw allows attackers who control any user in the master realm to escalate privileges to master realm administrator. The issue has been resolved in version 1.22.1.