CVE-2026-16105: Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A missing authorization check vulnerability was discovered in Keycloak admin REST API name-based composite endpoints. The flaw exists in the RoleContainerResource where the name-based path (/admin/realms/{realm}/roles/{role-name}/composites) was not updated with the security fixes previously applied to the id-based path. The root cause is the failure to validate that a delegated administrator has the necessary permissions to modify built-in admin roles when using the name-based resource path. An attacker with manage-realm permissions can exploit this by sending a DELETE request to the name-based composite endpoint. Successful exploitation allows an attacker to remove the manage-users, impersonation, or manage-clients child roles from the built-in admin role, thereby degrading the permissions of other administrators within the same realm.

— Red Hat