CVE-2026-16105 — Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authoriz…
Published: 2026-07-31 · CVSS: 4.9 · CVSS 3.1
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7