Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

published 2026-06-11 4 mo ago modified 2026-09-08 2 mo ago also BIT-keycloak-2026-11986 , EUVD-2026-36267 , GHSA-6w3v-mcfh-m3q7

cvss: 4.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

Patch / fix

fixed in 3 links 3

maven org.keycloak:keycloak-rest-admin-ui-ext 26.7.0
bitnami keycloak 26.6.5
Red Hat Red Hat build of Keycloak 26.6 26.6-11, 26.6.5-1

github.com/keycloak/keycloak@f3831f0 commit
github.com/keycloak/keycloak#49826 pull request
github.com/keycloak/keycloak/releases/tag/26.7.0 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-11986 updated 2026-08-05 cvss 4.9

keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak

Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-11, rhbk/keycloak-rhel9-operator 26.6-11, rhbk/keycloak-operator-bundle 26.6.5-1
fixed: vendor fix RHSA-2026:50849
Red Hat build of Keycloak 26.6.5
fixed: vendor fix RHSA-2026:50848
Red Hat JBoss Enterprise Application Platform Expansion Pack keycloak-rest-admin-ui-ext 26.2.4.redhat-00030
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-06-11)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
GitHub	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.keycloak:keycloak-rest-admin-ui-ext	<26.7.0	26.7.0
bitnami	keycloak	>=26.6.0, <26.6.5	26.6.5

Affected products

Red Hat Red Hat build of Keycloak 26.6
Red Hat Red Hat build of Keycloak 26.6.5
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Classification

Weakness

CWE-425 Direct Request

References

github.com /keycloak/keycloak/pull/49826
web
github.com /keycloak/keycloak/commit/f3831f01fd4abceb47e9675ab5f4c17268ba9e9d
web
access.redhat.com /errata/RHSA-2026:50848
vendor-advisory, web, advisory
access.redhat.com /errata/RHSA-2026:50849
vendor-advisory, web, advisory
access.redhat.com /security/cve/CVE-2026-11986
vdb-entry, web, vendor-advisory, advisory
bugzilla.redhat.com /show_bug.cgi?id=2487906
issue-tracking, web, vendor-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2026-11986
advisory, web
github.com /keycloak/keycloak/issues/49766
web
github.com /keycloak/keycloak
package
github.com /keycloak/keycloak/releases/tag/26.7.0
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary