Keycloak has recently resolved a critical access control vulnerability that permitted limited administrators to access sensitive user data beyond their authorization levels. This flaw, identified as CVE-2026-17059, posed a significant risk to user privacy by allowing unauthorized access to usernames, email addresses, and other profile information.
Details of the Keycloak Vulnerability
The vulnerability was discovered by Enzo Mongin, a researcher from Escape, and it impacts the Keycloak Admin REST API. It was formally acknowledged by Red Hat on July 24, 2026, and a corrective update, Keycloak version 26.7.0, was released on July 28, 2026.
The issue was located in a specific API endpoint used for listing members assigned to roles: GET /admin/realms/{realm}/roles/{role-name}/users. Restricted administrators, possessing only query-users and view-realm permissions, could exploit this endpoint to obtain comprehensive user data, including usernames, email addresses, and account statuses.
Implications and Risks
Keycloak’s standard user-listing API correctly restricted access, returning empty responses for unauthorized queries. However, the role-members endpoint did not apply the same user-level authorization checks, leading to potential unauthorized data exposure.
This oversight could result in privacy breaches within shared Keycloak environments, particularly affecting accounts designed to have limited directory access, such as support or helpdesk roles.
Remediation and Recommendations
The vulnerability is classified as broken object-level authorization (CWE-639), with a CVSS score of 6.5, indicating a medium risk level. It specifically affects environments where limited admin roles are delegated, highlighting the need for careful access control configurations.
The security patch now enforces per-user visibility checks before returning user records. Deployments using the default permission model, with adminPermissionsEnabled set to false, are primarily affected. Organizations are urged to upgrade to Keycloak version 26.7.0 or later and reassess roles with query-users and view-realm permissions.
Security teams should also evaluate sibling API endpoints to ensure consistent enforcement of access controls, as securing primary routes does not guarantee protection across all pathways.
In conclusion, organizations must promptly update their Keycloak deployments and review their access control policies to safeguard user data effectively.
