org.keycloak:keycloak-guides (21.1.2), org.keycloak:keycloak-guides-maven-plugin (21.1.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.1.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 21.1.2 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.4), org.keycloak:keycloak-guides-maven-plugin (23.0.4) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.4 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (25.0.5), org.keycloak:keycloak-guides-maven-plugin (25.0.5) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (25.0.5)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 25.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 25.0.5 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (21.0.2), org.keycloak:keycloak-guides-maven-plugin (21.0.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 21.0.2 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (22.0.0), org.keycloak:keycloak-guides-maven-plugin (22.0.0) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (22.0.0)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 22.0.0 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (22.0.5), org.keycloak:keycloak-guides-maven-plugin (22.0.5) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (22.0.5)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 22.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 22.0.5 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.0), org.keycloak:keycloak-guides-maven-plugin (23.0.0) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.0)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.0 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.3), org.keycloak:keycloak-guides-maven-plugin (23.0.3) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.3)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.3 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (24.0.4), org.keycloak:keycloak-guides-maven-plugin (24.0.4) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (24.0.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 24.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 24.0.4 - org.keycloak:keycloak-guides-maven-plugin...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0, <=0.2.0), org.keycloak:keycloak-guides (21.0.1) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics =0.1.0, =0.2.0 -...

org.keycloak:keycloak-guides (23.0.5), org.keycloak:keycloak-guides-maven-plugin (23.0.5) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.5)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.5 - org.keycloak:keycloak-guides-maven-plugin...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +32 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=21.0.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =21.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.4 and more Source cves:...

CVE-2026-11986

CVE-2026-11986 involves the Keycloak admin-ui-ext component. The root cause is that certain bulk role-removal endpoints do not perform granular permission checks when deleting role mappings, enabling a delegated administrator with limited permissions to remove highly privileged roles from other u...

CVE-2026-11986

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=5.6.0, <=5.7.3), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=9.2, <=9.5) +26 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=26.6.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =26.6.0, =5.6.0, =9.2, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =2...

PT-2026-80238

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

CVE-2026-11986: Direct Request

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2026-9088 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2026-9802 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2026-9793 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...