CVE-2026-11986: Keycloak Admin Permission Bypass Allows Unauthorized Role Removal

Technical summary

CVE-2026-11986 exists in Keycloak's admin-ui-ext (extended administrative UI) component. The vulnerability stems from insufficient permission validation on bulk role-removal endpoints. Specifically, when processing requests to delete role mappings in batch operations, the application fails to enforce granular permission checks that would normally restrict which roles a delegated administrator can modify. This allows an authenticated principal with limited administrative scope to remove role assignments that should be protected by higher-privilege requirements. The CWE-425 classification (Direct Request to Handler) indicates the flaw relates to inappropriate access to functionality intended for higher-privilege callers.

Business impact

The primary risk is administrative privilege erosion. A delegated admin (e.g., one scoped to manage users in a specific realm or tenant) can remove administrative or sensitive roles from other users, including superusers. This creates operational disruption—legitimate administrators lose access and cannot function—and potential security incidents if malicious actors gain delegated admin rights and weaponize this flaw to disable oversight. Organizations relying on role-based delegation for multi-tenant or federated identity governance face compromised segregation of duties.

Affected systems

The vulnerability affects Keycloak installations that use the admin-ui-ext component, which provides extended administrative capabilities. No specific version range is provided in the vulnerability record; organizations must consult the official Keycloak advisory to determine which releases are affected and whether patches are available.

Exploitability

Exploitation requires an authenticated principal with some degree of delegated administrative privileges. An attacker cannot exploit this remotely without valid credentials; however, once a delegated admin account is compromised or a malicious insider holds such a role, the flaw can be exploited trivially via standard HTTP requests to the affected bulk role-removal endpoints. No user interaction is needed, and the attack surface is limited to organizations using delegated administration patterns.

Remediation

Apply security updates from the Keycloak project that add granular permission validation to bulk role-removal endpoints. Verify the patch against the official Keycloak security advisory to confirm the exact versions and release dates. As an interim control, restrict who receives delegated administrator roles and monitor bulk role-removal operations for anomalous patterns.

Patch guidance

Consult the official Keycloak security advisory for affected versions and available patches. Patches will restore proper permission checking so that delegated administrators cannot remove roles outside their intended scope. Test patches in a non-production environment before deploying to production Keycloak instances, particularly those managing critical identity infrastructure.

Detection guidance

Monitor logs for bulk role-removal API calls, especially those originating from delegated admin accounts removing high-privilege roles from other users or groups. Look for patterns where an admin with limited scope attempts to modify roles outside their designated area of responsibility. Review role membership changes in security or auditing contexts to identify unexpected removals of administrative accounts.

Why prioritize this

While the CVSS score is MEDIUM (4.9), the business impact is significant in environments relying on delegated administration. The flaw directly undermines access control segregation, a foundational security principle. Organizations should prioritize patching if they use Keycloak's delegated admin features, particularly in multi-tenant or federated deployments where privilege isolation is critical.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a network-accessible vulnerability (AV:N) requiring high privileges (PR:H) to trigger, with no complexity (AC:L), resulting in high integrity impact (I:H) but no confidentiality or availability impact. The 'MEDIUM' severity appropriately captures that exploitation requires an authenticated attacker with pre-existing admin rights, limiting its reach. However, organizations treating this as low-priority solely based on the numeric score should reconsider the operational and governance impact of admin privilege loss.

Frequently asked questions