GitHub Advisoryadvisory · Maven

GHSA-6w3v-mcfh-m3q7 Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

MEDIUM Published 2026-06-11 Modified 2026-08-19 Official page ↗
Aliases
CVE-2026-11986
Ecosystem
Maven
Packages
org.keycloak:keycloak-rest-admin-ui-ext
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-425
Reviewed
2026-08-19

Affected packages

• Maven org.keycloak:keycloak-rest-admin-ui-ext: < 26.7.0 → fixed in 26.7.0

Description

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

Related

Alias · CVE (1)

  • CVE-2026-11986 A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. vulnerability

Weakness · CWE (1)

References