CVE-2026-16106: Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators.
Other sources
An incorrect authorization flaw was found in the Keycloak admin REST API endpoints responsible for removing child roles from composite roles. Specifically, the DELETE /admin/realms/{realm}/roles-by-id/{role-id}/composites and DELETE /admin/realms/{realm}/roles/{role-name}/composites endpoints only verify if the caller has manage permissions on the parent role container. They fail to enforce the per-child role check that is correctly implemented in the corresponding add operation. To exploit this, an attacker must have a delegated admin account with manage permissions on a parent role container (such as manage-realm or Fine-Grained Admin Permissions on a specific role container). No user interaction is required. A successful attack allows a delegated administrator to remove privileged child roles (like realm-admin) from existing composites. This results in stripping those roles from all users or groups assigned to the composite, effectively degrading the privileges of other administrators or disrupting realm-wide functionality by modifying default roles.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Keycloak admin REST API endpoints that allow role-composite deletion: DELETE /admin/realms/{realm}/roles-by-id/{role-id}/composites and DELETE /admin/realms/{realm}/roles/{role-name}/composites, allowing only trusted admins (limit delegated admin accounts so they do not have manage permissions on parent role containers they do not need, e.g., manage-realm or Fine-Grained Admin Permissions on specific role containers).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16106?
The severity of CVE-2026-16106 is medium with a CVSS score of 4.9.
How do I fix CVE-2026-16106?
To fix CVE-2026-16106, ensure that appropriate authorization checks are implemented for role-composite deletions in Keycloak.
Who is affected by CVE-2026-16106?
CVE-2026-16106 affects Keycloak users, particularly those using the admin REST API with delegated administration.
What type of vulnerability is CVE-2026-16106?
CVE-2026-16106 is an authorization vulnerability allowing a delegated admin to improperly remove privileged child roles.
What impact does CVE-2026-16106 have on my system?
CVE-2026-16106 may allow unauthorized removal of critical roles, potentially leading to privilege escalation within Keycloak.