CVE-2026-16106 is a vulnerability in the admin REST API of Red Hat Build of Keycloak. The flaw arises when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage. This results in loss of access for other users and administrators. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.9 (Medium), with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory indicating a patch or fix at this time.

An attacker with limited administrative privileges can exploit this vulnerability to remove privileged roles from composite roles without authorization. This can disrupt role-based access control by causing loss of access for other users and administrators, potentially impacting the integrity of the system's access management. There is no confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16106 for current remediation guidance. Until a fix is available, restrict delegated administrator permissions carefully and monitor administrative actions related to role management to mitigate potential abuse.