CVE-2026-16106

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the admin REST API of Keycloak, an identity and access management solution. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, which can result in a loss of access for other users and administrators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.