CVE-2026-11986

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=5.6.0, <=5.7.3), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=9.2, <=9.5) +26 more potentially affected by CVE-2026-11986 via org.keycloak:keycloak-rest-admin-ui-ext (>=26.6.0, <=26.6.4)

org.keycloak:keycloak-rest-admin-ui-ext MAVEN version =26.6.0, =5.6.0, =9.2, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =26.6.0, =2...

PT-2026-80238

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

CVE-2026-11986: Direct Request

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...