Medium [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles.

This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess high-level delegated administrative privileges (manage-realm).

Successful exploitation allows an attacker to remove child roles from built-in admin roles, leading to a loss of integrity for administrative configurations. The vulnerability's root cause is an incomplete fix for a previous issue, where authorization checks were not consistently applied to name-based REST API endpoints.

Weakness: CWE-639. Affected Red Hat products: Red Hat Build of Keycloak.

Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.