THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-16105 (MEDIUM 4.9) — A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm per

[NVD] CVE-2026-16105 (MEDIUM 4.9) — A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm per

lownvdPublished 2026-07-31

CVE-2026-16105 CVSS: 4.9 MEDIUM Published: 2026-07-31T08:16:25.940

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-

Indicators of compromise

CVE-2026-16105cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16105