[NVD] CVE-2026-16106 (MEDIUM 4.9) — A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative p

CVE-2026-16106 CVSS: 4.9 MEDIUM Published: 2026-07-17T17:17:14.510

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not