CVE-2026-11986
published 2026-06-11CVE-2026-11986: A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because…
PriorityP430medium4.9CVSS 3.1
AVNACLPRHUINSUCNIHAN
EPSS
0.30%
21.6th percentile
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| rhbk-openshift-rhel9 | rhbk-openshift-rhel9 | — | — |
| rhbk | keycloak-rhel9 | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities.
ghsa_unreviewed·2026-06-11
CVE-2026-11986 [MEDIUM] CWE-425 A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities.
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
VulDB
Keycloak on Red Hat direct request
vuldb·2026-06-11·CVSS 4.9
CVE-2026-11986 [MEDIUM] Keycloak on Red Hat direct request
A vulnerability, which was classified as problematic, has been found in Keycloak on Red Hat. Impacted is an unknown function. This manipulation causes direct request.
This vulnerability is handled as CVE-2026-11986. The attack can be initiated remotely. There is not any exploit available.
GHSA
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
ghsa·2026-06-11
CVE-2026-11986 [MEDIUM] CWE-425 Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
Red Hat
keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak
vendor_redhat·2026-06-11·CVSS 4.9
CVE-2026-11986 [MEDIUM] CWE-425 keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak
keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess high-level administrative privileges (delegated administrator) to b
No detection rules found.
No public exploits indexed.
2026-06-11
Published