SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-16105

MEDIUM · CVSS 4.9 EPSS 0.19%

Source: NVD + CISA KEV + EPSS · Published 2026-07-31 · Last synced 2026-08-30

CyberRota Analysis

AI-Generated

A vulnerability exists in the RoleContainerResource component of Keycloak, where inadequate authorization checks in specific name-based endpoints of the admin REST API allow delegated administrators to manipulate composite roles. This could lead to the unauthorized removal of critical child roles from built-in admin roles, potentially disrupting administrative functions within a realm. Organizations utilizing Keycloak, particularly those with delegated administration setups, should prioritize addressing this issue to maintain proper role management and security integrity.

CVE
CVE-2026-16105
Severity
MEDIUM
CVSS
4.9
EPSS
0.19%

Original NVD Description

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.

Related CVEs

Other vulnerabilities affecting the same vendor(s)