Executive brief
A security flaw has been identified in Keycloak, an open-source identity and access management solution. The issue allows a delegated administrator—someone with limited management rights—to bypass security checks and remove critical permissions from high-level administrative roles. This could lead to a disruption of administrative functions, effectively locking out or degrading the capabilities of other system administrators within the affected environment.
Technical details
A missing authorization check vulnerability exists in the Keycloak admin REST API name-based composite endpoints. The flaw is located in the RoleContainerResource where the name-based path (/admin/realms/{realm}/roles/{role-name}/composites) failed to implement security fixes previously applied to the ID-based path. An attacker with 'manage-realm' permissions can exploit this by sending a DELETE request to the name-based composite endpoint. This allows the removal of critical child roles (such as manage-users, impersonation, or manage-clients) from built-in admin roles, leading to a privilege degradation for other administrators. The vulnerability is tracked as CWE-285 (Improper Authorization).
Affected products
- Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-17: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-31: advisory: NVD publication date