BIT-KEYCLOAK-2026-11986 Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +6 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (24.0.5)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 24.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak 24.3.0.0 -...

org.keycloak:keycloak-guides (25.0.2), org.keycloak:keycloak-guides-maven-plugin (25.0.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (25.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 25.0.2 - org.keycloak:keycloak-guides-maven-plugin...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0, <=4.0.1-25.0), org.keycloak:keycloak-guides (25.0.1) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (25.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =3.0.1-25.0, =4.0.1-25.0 -...

org.keycloak:keycloak-guides (23.0.2), org.keycloak:keycloak-guides-maven-plugin (23.0.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.2 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (21.0.0), org.keycloak:keycloak-guides-maven-plugin (21.0.0) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.0.0)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 21.0.0 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (24.0.1), org.keycloak:keycloak-guides-maven-plugin (24.0.1) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (24.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 24.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 24.0.1 - org.keycloak:keycloak-guides-maven-plugin...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=2.7.4-24.0), org.keycloak:keycloak-guides (24.0.2) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (24.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =2.5.6-24.0, =2.7.4-24.0 -...

org.keycloak:keycloak-guides (21.1.2), org.keycloak:keycloak-guides-maven-plugin (21.1.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.1.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 21.1.2 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.7), org.keycloak:keycloak-guides-maven-plugin (23.0.7) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.7)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.7 - org.keycloak:keycloak-guides-maven-plugin...

Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0, <=5.7.3), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1, <=9.5) +28 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=26.0.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.0, =26.2.0, =26.2.0...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0, <=0.2.0), org.keycloak:keycloak-guides (21.0.1) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics =0.1.0, =0.2.0 -...

org.keycloak:keycloak-guides (22.0.4), org.keycloak:keycloak-guides-maven-plugin (22.0.4) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (22.0.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 22.0.4 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.1), org.keycloak:keycloak-guides-maven-plugin (23.0.1) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.1 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (22.0.3), org.keycloak:keycloak-guides-maven-plugin (22.0.3) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (22.0.3)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 22.0.3 - org.keycloak:keycloak-guides-maven-plugin...

io.kokuwa.keycloak:keycloak-event-metrics (1.0.0), org.keycloak:keycloak-guides (21.1.1) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.1.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 1.0.0 - org.keycloak:keycloak-guides...

GHSA-6W3V-MCFH-M3Q7 Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +32 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=21.0.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =21.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.4 and more Source cves:...

CVE-2026-11986

CVE-2026-11986 involves the Keycloak admin-ui-ext component. The root cause is that certain bulk role-removal endpoints do not perform granular permission checks when deleting role mappings, enabling a delegated administrator with limited permissions to remove highly privileged roles from other u...