CVE-2026-16105

MediumCVSS 4.9/10Last modified Sep 16, 2026

Description

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2026
Last modified: Sep 16, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-161064.9A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated adminis CVE-2026-161075.9IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could all CVE-2026-161086.5A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups CVE-2026-16116.4The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all v CVE-2026-161117.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could all CVE-2026-1611710.0Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. F CVE-2026-161187.1A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file CVE-2026-161196.3A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec CVE-2026-16126.9AL-KO Robolinho Update Software has hard-coded AWS Access and Secret keys that allow anyone to access AL-KO's AWS bucket. Using the keys dir CVE-2026-161206.3A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the CVE-2026-161216.3A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_a CVE-2026-161224.3A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/Reque