CVE-2026-11986: Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
Other sources
An authorization bypass vulnerability exists in the Keycloak admin-ui-ext bulk role-mapping-delete endpoints (POST /admin/realms/{realm}/ui-ext/role-mapping-delete/users/{id} and POST /admin/realms/{realm}/ui-ext/role-mapping-delete/groups/{id}). The implementation only performs a container-level authorization check (requireMapRoles) but fails to enforce the per-role authorization check (requireMapRole) required by the standard Admin REST API. As a result, an authenticated attacker with high privileges (specifically a delegated administrator with manage-users permissions) can bypass intended restrictions to remove sensitive realm-management roles (such as manage-realm, manage-clients, or realm-admin) from other administrators. This operation is correctly blocked with a 403 Forbidden error when attempted via the standard Admin REST API.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
keycloak/admin-ui-ext (admin-ui-ext)to a version that resolves this vulnerability.Patch Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak - Compensating control
If you cannot immediately patch, restrict access to the Keycloak admin-ui-ext bulk role-mapping-delete endpoints (POST /admin/realms/{realm}/ui-ext/role-mapping-delete/users/{id} and POST /admin/realms/{realm}/ui-ext/role-mapping-delete/groups/{id}) so only fully trusted administrators can reach them (e.g., via network/firewall/ACL or an upstream access control in front of Keycloak).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11986?
The severity of CVE-2026-11986 is rated as medium with a score of 4.9.
What does CVE-2026-11986 affect?
CVE-2026-11986 affects the Keycloak admin-ui-ext component and its bulk role-mapping-delete endpoints.
How can I fix CVE-2026-11986?
To fix CVE-2026-11986, ensure you are running the latest version of Keycloak that addresses this vulnerability.
What is the risk associated with CVE-2026-11986?
CVE-2026-11986 poses a risk level classified as 30 due to its potential for authorization bypass.
What type of vulnerability is CVE-2026-11986?
CVE-2026-11986 is an authorization bypass vulnerability in the Keycloak admin-ui-ext component.