The flaw resides in the RoleContainerResource component of Keycloak’s admin REST API. Certain name‑based endpoints do not enforce proper authorization when handling composite roles. A delegated administrator with manage‑realm permissions can delete essential child roles from built‑in administrative roles, effectively disabling core administrative capabilities within a realm. This leads to loss of administrative control without providing remote code execution or direct system compromise.

Red Hat Build of Keycloak, Red Hat Single Sign‑On 7, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and other Red Hat builds that incorporate Keycloak services are affected.

The CVSS score of 4.9 classifies the vulnerability as moderate. An EPSS score of < 1 % and the absence from the CISA KEV list indicate a low likelihood of widespread exploitation. The flaw requires a delegatable role with manage‑realm access, meaning it is most likely an internal attack or a compromise of a privileged account. The primary consequence is loss of administrative control and disruption of normal operations; the vulnerability does not provide arbitrary code execution or remote access.