CVE-2026-11986

Published: Jun 11, 2026Modified: Aug 11, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.2 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.

Affected (1)

Products: Redhat: Build Of Keycloak

1 product

Build Of Keycloak

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Keycloak	From 26.6 to 26.6.5

Related CWEs

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (4)

https://access.redhat.com/errata/RHSA-2026:50848

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:50849

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-11986

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2487906

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.