Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-11T14:17:32 keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CWE-425

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess high-level administrative privileges (delegated administrator) to be exploited. Successful exploitation allows an attacker to remove critical administrative roles from other users, leading to an unauthorized modification of access controls. The vulnerability's root cause is the omission of granular per-role authorization checks in the bulk deletion endpoints of the admin-ui-ext extension. Red Hat would like to thank Wesley "Alardiians" Colquitt (Byteshyft Studios) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-operator-bundle:26.6.5-1 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9:26.6-11 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9-operator:26.6-11 Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 keycloak-rest-admin-ui-ext Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 rhbk/keycloak-rhel9 Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected keycloak-rest-admin-ui-ext https://www.cve.org/CVERecord?id=CVE-2026-11986 https://nvd.nist.gov/vuln/detail/CVE-2026-11986