The vulnerability exists in the admin-ui-ext extension of Red Hat build of Keycloak 26.6, where certain bulk role-removal endpoints do not enforce granular per-role authorization checks. This flaw allows a delegated administrator, who already has high-level administrative privileges, to remove highly privileged roles from other users or groups. The root cause is an authorization bypass due to missing fine-grained permission validation in the bulk deletion endpoints. The CVSS v3.1 base score is 4.9 (medium severity), reflecting network attack vector, low complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Red Hat has published a security advisory and released version 26.6.5 with a fix for this vulnerability.

Successful exploitation allows an attacker with delegated administrator privileges to remove critical administrative roles from other users or groups, leading to unauthorized modification of access controls and potential disruption of administrative functions. There is no direct confidentiality or availability impact. The attack requires high privileges and no user interaction.

A security update is available in Red Hat build of Keycloak version 26.6.5 that addresses this vulnerability. Users should upgrade to this fixed version to remediate the issue. No other mitigations meeting Red Hat's criteria for ease of use, applicability, or stability are currently available. Administrators should apply the update after backing up existing installations.