A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

An authorization bypass vulnerability exists in the Keycloak admin-ui-ext bulk role-mapping-delete endpoints (POST /admin/realms/{realm}/ui-ext/role-mapping-delete/users/{id} and POST /admin/realms/{realm}/ui-ext/role-mapping-delete/groups/{id}). The implementation only performs a container-level authorization check (requireMapRoles) but fails to enforce the per-role authorization check (requireMapRole) required by the standard Admin REST API. As a result, an authenticated attacker with high privileges (specifically a delegated administrator with manage-users permissions) can bypass intended restrictions to remove sensitive realm-management roles (such as manage-realm, manage-clients, or realm-admin) from other administrators. This operation is correctly blocked with a 403 Forbidden error when attempted via the standard Admin REST API.