Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak (CVE-2026-11986)

Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak (CVE-2026-11986) | HOL Guard CVE

Why this deserves its current priority

CVSS is 4.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps org.keycloak:keycloak-rest-admin-ui-ext (maven), org.keycloak:keycloak-rest-admin-ui-ext (maven). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:redhat:build_of_keycloak::::::::	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
org.keycloak:keycloak-rest-admin-ui-extmaven	>=0 <26.7.0	26.7.0
org.keycloak:keycloak-rest-admin-ui-extmaven	<26.7.0	26.7.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for org.keycloak:keycloak-rest-admin-ui-ext, org.keycloak:keycloak-rest-admin-ui-ext.
Review the reported fix. Update org.keycloak:keycloak-rest-admin-ui-ext to 26.7.0; org.keycloak:keycloak-rest-admin-ui-ext to 26.7.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 5, 2026

Sources and claim methodology

Upstream source description

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

Quoted source text, attributed separately from HOL analysis.