org.keycloak:keycloak-guides (25.0.2), org.keycloak:keycloak-guides-maven-plugin (25.0.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (25.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 25.0.2 - org.keycloak:keycloak-guides-maven-plugin...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0, <=4.0.1-25.0), org.keycloak:keycloak-guides (25.0.1) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (25.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =3.0.1-25.0, =4.0.1-25.0 -...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (4.0.2-25.0), org.keycloak:keycloak-guides (25.0.4) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (25.0.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 25.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests 4.0.2-25.0 -...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.0.3-25.0, <=4.0.5-25.0), org.keycloak:keycloak-guides (25.0.6) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (25.0.6)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 25.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =4.0.3-25.0, =4.0.5-25.0 -...

GHSA-6W3V-MCFH-M3Q7 Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

io.kokuwa.keycloak:keycloak-event-metrics (1.0.0), org.keycloak:keycloak-guides (21.1.1) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.1.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 1.0.0 - org.keycloak:keycloak-guides...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0, <=0.2.0), org.keycloak:keycloak-guides (21.0.1) +5 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics =0.1.0, =0.2.0 -...

org.keycloak:keycloak-guides (21.0.2), org.keycloak:keycloak-guides-maven-plugin (21.0.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (21.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 21.0.2 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (22.0.2), org.keycloak:keycloak-guides-maven-plugin (22.0.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (22.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 22.0.2 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (22.0.5), org.keycloak:keycloak-guides-maven-plugin (22.0.5) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (22.0.5)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 22.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 22.0.5 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.0), org.keycloak:keycloak-guides-maven-plugin (23.0.0) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.0)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.0 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.1), org.keycloak:keycloak-guides-maven-plugin (23.0.1) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.1)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.1 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.2), org.keycloak:keycloak-guides-maven-plugin (23.0.2) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.2)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.2 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.3), org.keycloak:keycloak-guides-maven-plugin (23.0.3) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.3)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.3 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.6), org.keycloak:keycloak-guides-maven-plugin (23.0.6) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.6)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.6 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.7), org.keycloak:keycloak-guides-maven-plugin (23.0.7) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.7)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.7 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (23.0.5), org.keycloak:keycloak-guides-maven-plugin (23.0.5) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (23.0.5)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 23.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 23.0.5 - org.keycloak:keycloak-guides-maven-plugin...

org.keycloak:keycloak-guides (24.0.0), org.keycloak:keycloak-guides-maven-plugin (24.0.0) +4 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (24.0.0)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version 24.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-rest-admin-ui-ext and may be impacted: - org.keycloak:keycloak-guides 24.0.0 - org.keycloak:keycloak-guides-maven-plugin...

CVE-2026-11986

CVE-2026-11986 involves the Keycloak admin-ui-ext component. The root cause is that certain bulk role-removal endpoints do not perform granular permission checks when deleting role mappings, enabling a delegated administrator with limited permissions to remove highly privileged roles from other u...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +32 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=21.0.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =21.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.4 and more Source cves:...