Sorry for late response, but this one ended up in my spam for some reason. KEYCLOAK-1735 is not a bug as by definition a bug is something that not works as designed. I agree with you that the approach is less than elegant, which is why we have an outstanding issue to enhance this. At some point we are going to redesign the admin permissions to provide more fine grained control, which will make it possible to create admins that can manage groups of users and/or roles. However, the way it works now is that it's an all or nothing thing. End of the day though if someone with manage-users role was prevented from making them selves an admin of Keycloak, they would still have the power to make themselves an admin (or the equivalent role) in your applications and in that way obtaining full permissions to all your business logic/data. So that's a permissions you should only give to a trusted individual in the first place. With that in mind I disagree that this is really a vulnerability, but I appreciate that the permission is to course for most. On 13 October 2015 at 20:15, David Illsley <davidillsley(a)gmail.com&gt; wrote: