keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

CVE-2026-16106

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

PT-2026-60801

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the admin REST API of Keycloak, an identity and access management solution. The issue occurs when a delegated administrator attempts to remove a child role from a composite...