A newly disclosed security vulnerability in Keycloak, the widely used open-source identity and access management (IAM) platform maintained by the Keycloak community and serving as the foundation for the Red Hat build of Keycloak, has raised concerns over unauthorized exposure of personally identifiable information (PII).
Tracked as CVE-2026-17059, the flaw stems from a broken access control weakness that allows restricted administrator accounts to retrieve sensitive user information through a role membership endpoint, bypassing the visibility restrictions enforced by the primary user directory API.
Although the vulnerability requires authenticated administrative access, it demonstrates how inconsistent authorization checks across similar endpoints can create significant data exposure risks in enterprise identity infrastructures.
Keycloak CVE-2026-17059 Flaw
The issue affects the endpoint responsible for listing members of a specific role: GET /admin/realms/{realm}/roles/{role-name}/users.
Under Keycloak’s default administrative permission model, administrators assigned only the query-users and view-realm roles are intentionally prevented from browsing or searching the full user directory.
When these restricted accounts query the primary endpoint, GET /admin/realms/{realm}/users, the platform correctly returns an empty response because each user record is evaluated against the caller’s permissions before being included in the results. This behavior ensures administrators only view identities they are explicitly authorized to access.
However, researchers discovered that the role-members endpoint failed to apply the same authorization logic. Instead of filtering individual user records based on visibility permissions, the endpoint merely verified whether the caller had permission to view the role and execute general user queries.
As a result, any restricted administrator capable of viewing a role could enumerate every user assigned to that role, regardless of whether those accounts should remain hidden.
The API response exposed valuable personal information including usernames, email addresses, first and last names, account status, and email verification state, effectively bypassing Keycloak’s intended access controls.
The vulnerability was identified by security researchers at Escape Tech during automated security testing against a live Keycloak 999.0.0-SNAPSHOT build at commit 33695405ea.
Researchers successfully demonstrated the flaw using only two API requests and a single restricted administrator token, confirming that exploitation was straightforward once the necessary permissions were available.
The vulnerability received a CVSS v3.1 score of 6.5 (Medium Severity) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting the high confidentiality impact despite requiring authenticated administrative privileges.
In practical enterprise deployments, the vulnerability could significantly impact organizations operating shared Keycloak realms across multiple business units or departments.
Helpdesk administrators, support teams, or delegated administrators with intentionally limited visibility could silently collect directories of users outside their authorized scope simply by querying role memberships.
While the flaw does not allow privilege escalation or account modification, unauthorized disclosure of employee identities and email addresses can facilitate phishing campaigns, insider reconnaissance, credential attacks, or compliance violations involving sensitive user data.
Fortunately, deployments using Fine-Grained Admin Permissions v2 remain unaffected. In this configuration, authorization filtering occurs at the data store layer, ensuring role membership queries automatically exclude users the requesting administrator is not permitted to view.
This architectural difference effectively prevents the sibling-endpoint authorization gap responsible for CVE-2026-17059.
The disclosure process moved rapidly following responsible reporting. Escape Tech submitted the vulnerability to the Keycloak security team on July 18, 2026, receiving acknowledgment the same day.
Red Hat publicly assigned CVE-2026-17059 on July 24, crediting Escape researcher Enzo Mongin (Orionexe) for the discovery.
A fix was released on July 28 as part of Keycloak 26.7.0, introducing a single authorization filter.filter(auth.users()::canView), to ensure role membership results undergo the same visibility validation as the primary user listing endpoint.
Organizations running self-hosted Keycloak instances or the Red Hat build should prioritize upgrading to Keycloak 26.7.0 to eliminate the vulnerability.
Security teams should also review delegated administrator roles, audit API access logs for unusual role-member enumeration activity, and consider enabling Fine-Grained Admin Permissions v2 for stronger defense against similar authorization inconsistencies.
The incident serves as another reminder that access control must be implemented consistently across every API endpoint, as even minor authorization gaps can expose sensitive enterprise identity data.
No Comment! Be the first one.