EUVD-2026-36267
GHSA-6w3v-mcfh-m3q7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Network-accessible admin-UI endpoint warrants AV:N; delegated admin credentials are required (PR:H); only role-mapping integrity is affected, so C:N and A:N but I:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1Blast Radius
ecosystem impact- 31 maven packages depend on org.keycloak:keycloak-rest-admin-ui-ext (2 direct, 29 indirect)
Ecosystem-wide dependent count for version 26.7.0.
DescriptionCVE.org
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
AnalysisAI
Broken access control in the admin-ui-ext component of Red Hat Build of Keycloak permits an authenticated delegated administrator to exploit missing granular permission checks on bulk role-removal endpoints, stripping highly privileged roles from arbitrary users or groups within the Keycloak realm. Affected deployments are those using Keycloak's delegated administration model with the admin-ui-ext extension active; exploitation is bounded by the PR:H CVSS requirement, meaning an attacker must already hold delegated admin credentials. No public exploit has been identified and the vulnerability is not listed in CISA KEV, placing real-world risk in the moderate range with highest relevance to environments with partially trusted delegated administrators.
Technical ContextAI
Keycloak implements a delegated administration model that allows sub-administrators to manage specific realms, groups, or users within defined scopes. The admin-ui-ext component augments the standard Keycloak Admin UI with extended bulk-operation capabilities, including bulk role mapping removal. The root cause is CWE-425 (Direct Request / Forced Browsing): the bulk role-removal API endpoints process incoming requests and execute role-mapping deletions without verifying whether the requesting delegated admin holds sufficient permission over the specific roles being removed - they validate only that some delegated admin credential is present. This allows a sub-admin scoped to limited operations to call the endpoint directly and target privileged roles outside their authorized scope. Affected products per CPE data include Red Hat Build of Keycloak (cpe:2.3:a:red_hat:red_hat_build_of_keycloak) across all listed versions, and Red Hat JBoss Enterprise Application Platform Expansion Pack (cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack). The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) confirms a network-accessible attack surface with low exploitation complexity once credentials are obtained.
RemediationAI
No specific patched version was confirmed in the available intelligence data; administrators should consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11986 and monitor https://bugzilla.redhat.com/show_bug.cgi?id=2487906 for patch availability and exact fix versions. As a compensating control, limit delegated administrator role assignments exclusively to fully trusted personnel and immediately audit all existing delegated admin grants to identify accounts that may have already exercised this flaw. Restricting network-level access to the admin-ui-ext bulk role-removal endpoints via reverse-proxy ACL or API gateway policy can reduce exposure without disabling the entire component, though this trades off the operational efficiency of bulk operations for administrative teams. Enabling and actively monitoring Keycloak's admin event audit log for anomalous bulk role-removal events provides a detective control that can surface exploitation attempts in environments where preventive controls cannot yet be applied. Apply the principle of least privilege rigorously to all delegated admin scope definitions to minimize the blast radius of any future privilege misuse.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-425 – Direct Request ('Forced Browsing')
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today