Keycloak has addressed a broken access control vulnerability that could allow restricted administrators to access usernames, email addresses, and other profile information belonging to users outside their permitted scope.
This issue, tracked as CVE-2026-17059, affects the Keycloak Admin REST API and was discovered by Escape researcher Enzo Mongin, known as Orionexe.
Red Hat published the CVE on July 24, 2026, and Keycloak remediated the flaw on July 28 with the release of Keycloak version 26.7.0.
The vulnerability exists in the endpoint used to list members assigned to a specific role:
GET /admin/realms/{realm}/roles/{role-name}/users
A restricted administrator with only the query-users and view-realm permissions could call this endpoint and obtain full user records for members of roles they were authorized to view. The exposed information includes usernames, email addresses, first and last names, account status, and email verification status.
Keycloak Vulnerability
Escape found that Keycloak correctly protected its primary user-listing endpoint. When a restricted administrator queried the standard users API, Keycloak returned an empty response because the account lacked the view-users privilege.
However, the role-members endpoint enforced only broad role-viewing and user-query permissions without applying the same per-user authorization filter.
As a result, the same token that returned an empty list from the main users endpoint could retrieve personal data through the role-members API.
This creates a privacy risk in shared Keycloak realms, particularly where a helpdesk-style account may be intentionally restricted from browsing the entire user directory.
The flaw is classified as broken object-level authorization, also known as broken access control, under CWE-639, and it has a CVSS score of 6.5, rated as Medium.
Exploitation requires an authenticated but deliberately limited administrator account, making this particularly relevant for organizations that delegate partial Keycloak administration to support teams or business units.
The vulnerable code path was located in RoleContainerResource.getUsersInRole, which fetched role members and directly converted them into user representations without checking whether the caller was authorized to view each individual user.
The fix adds the necessary per-user visibility validation before user records are returned. Realms using fine-grained admin permissions version 2 are not affected, as filtering occurs at the data-store layer. The exposure primarily impacts deployments that use the default permission model, where adminPermissionsEnabled is set to false.
Organizations should upgrade Keycloak to version 26.7.0 or later. Administrators should also review accounts assigned the query-users and view-realm roles, especially in multi-team environments.
Security teams should test sibling API endpoints for consistent authorization behavior, as a protected primary route does not guarantee that alternate paths enforce the same access controls.
