CVE-2026-11986
Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
- Record
CVE-2026-11986- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
EUVDEUVD-2026-36267
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
- Record
EUVD-2026-36267- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6w3v-mcfh-m3q7
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
- Record
GHSA-6w3v-mcfh-m3q7- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
NVD
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
- Record
CVE-2026-11986- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
OSVGHSA-6w3v-mcfh-m3q7
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
- Record
GHSA-6w3v-mcfh-m3q7- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
OSVBIT-keycloak-2026-11986 No score
Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
- Record
BIT-keycloak-2026-11986- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-rest-admin-ui-extMaven |
before 26.7.0 | 26.7.0 |
keycloakBitnami |
26.6.0 up to 26.6.5 | 26.6.5 |
org.keycloak:keycloak-rest-admin-ui-extMaven |
before 26.7.0, plus listed versions 21.0.021.0.121.0.221.1.021.1.1 Show 45 moreShow less21.1.222.0.022.0.122.0.222.0.322.0.422.0.523.0.023.0.123.0.223.0.323.0.423.0.523.0.623.0.724.0.024.0.124.0.224.0.324.0.424.0.525.0.025.0.125.0.225.0.325.0.425.0.525.0.626.0.026.0.126.0.226.0.326.0.426.0.526.0.626.0.726.0.826.1.026.1.126.1.226.1.326.1.426.1.526.2.026.2.1 |
26.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-11986 is a medium vulnerability (CVSS 4.9) in Red Hat Build Of Keycloak 26.6, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in org.keycloak:keycloak-rest-admin-ui-ext 26.7.0.
References
Left out here: 31 versions. The JSON record has them.