BIT-KEYCLOAK-2026-11986 Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

GHSA-6W3V-MCFH-M3Q7 Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +32 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=21.0.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =21.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.4 and more Source cves:...

CVE-2026-11986

CVE-2026-11986 involves the Keycloak admin-ui-ext component. The root cause is that certain bulk role-removal endpoints do not perform granular permission checks when deleting role mappings, enabling a delegated administrator with limited permissions to remove highly privileged roles from other u...

CVE-2026-11986

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=5.6.0, <=5.7.3), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=9.2, <=9.5) +26 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=26.6.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =26.6.0, =5.6.0, =9.2, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =2...

PT-2026-80238

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

CVE-2026-11986: Direct Request

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...