A broken access control vulnerability in Keycloak could allow unauthorized administrator accounts to access users’ personal information. This issue, tracked as CVE-2026-17059, affects the Keycloak Admin REST API and was discovered by researcher Enzo Mongin from Escape Research, also known as Orionexe.
The vulnerability was reported to the Keycloak team on July 18, 2026, acknowledged the same day, and assigned a CVE by Red Hat on July 24, 2026. Keycloak addressed the flaw on July 28, 2026, with the issue fixed in version 26.7.0.
CVE-2026-17059 has a CVSS 3.1 score of 6.5, which is rated as Medium severity. It is classified as a broken object-level authorization issue (CWE-639).
Keycloak Flaw
The vulnerability exists in the endpoint used to list members assigned to a role:
GET /admin/realms/{realm}/roles/{role-name}/usersKeycloak’s standard user-listing endpoint applies a per-user authorization check before returning user records. A restricted administrator assigned only the query-users and view-realm permissions, without the more powerful view-users permission, receives an empty response when calling the main users API.
However, Escape Research found that the role-members endpoint did not apply the same visibility filter. Instead, the affected RoleContainerResource.getUsersInRole method verified only that the requester could view the role and issue user queries, then directly returned user representations for every role member.
As a result, a restricted account that Keycloak otherwise treats as unable to browse the user directory could obtain user records through role membership queries.
The exposed information may include:
- Usernames
- Email addresses
- First and last names
- Account enabled status
- Email-verification status
In multi-team or multi-tenant Keycloak deployments, the flaw could enable helpdesk or support administrators to enumerate personal data belonging to users in other teams, bypassing intended segregation boundaries.
The issue affects realms using Keycloak’s default administration permission model, where adminPermissionsEnabled is set to false. The required permissions, query-users and view-realm, represent a deliberately limited administrative configuration often used for support workflows and search capabilities.
Realms using fine-grained admin permissions version 2 are not affected. In those environments, Keycloak filters role-member queries at the underlying storage layer, preventing unauthorized access to user data.
Escape Research validated the vulnerability against a Keycloak 999.0.0-SNAPSHOT build from the project’s main branch at commit 33695405ea.
The remediation adds a per-user canView authorization check to the role-member retrieval flow before user records are converted into API representations. This aligns the role-members endpoint with the protections already implemented by the main user-listing endpoint.
Administrators should upgrade to Keycloak 26.7.026.7.026.7.0 or later. Organizations should also review delegated administrative roles, identify accounts granted query-users and view-realm permissions, and assess whether user information may have been exposed via role-member API access before patching.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
