CyberRota Analysis
AI-GeneratedA vulnerability exists in the RoleContainerResource component of Keycloak, where inadequate authorization checks in specific name-based endpoints of the admin REST API allow delegated administrators to manipulate composite roles. This could lead to the unauthorized removal of critical child roles from built-in admin roles, potentially disrupting administrative functions within a realm. Organizations utilizing Keycloak, particularly those with delegated administration setups, should prioritize addressing this issue to maintain proper role management and security integrity.
Original NVD Description
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
Related CVEs
Other vulnerabilities affecting the same vendor(s)