An authorization bypass vulnerability exists in the Keycloak admin-ui-ext bulk role-mapping-delete endpoints (POST /admin/realms/{realm}/ui-ext/role-mapping-delete/users/{id} and POST /admin/realms/{realm}/ui-ext/role-mapping-delete/groups/{id}). The implementation only performs a container-level authorization check (requireMapRoles) but fails to enforce the per-role authorization check (requireMapRole) required by the standard Admin REST API.
As a result, an authenticated attacker with high privileges (specifically a delegated administrator with manage-users permissions) can bypass intended restrictions to remove sensitive realm-management roles (such as manage-realm, manage-clients, or realm-admin) from other administrators. This operation is correctly blocked with a 403 Forbidden error when attempted via the standard Admin REST API.