Keycloak, a widely used open-source identity and access management solution, has recently addressed a security vulnerability that could allow restricted administrators to access user information beyond their authorized scope. This flaw, identified as CVE-2026-17059, was discovered by researcher Enzo Mongin, also known as Orionexe, and was publicly disclosed by Red Hat on July 24, 2026. Keycloak released a patch on July 28, 2026, with the release of version 26.7.0.
The vulnerability resides in the Keycloak Admin REST API, specifically within the endpoint used to list members assigned to a particular role:
GET /admin/realms/{realm}/roles/{role-name}/users
Restricted administrators possessing only the query-users and view-realm permissions could exploit this endpoint to retrieve comprehensive user records for members of roles they are authorized to view. The exposed data includes usernames, email addresses, first and last names, account status, and email verification status.
Details of the Vulnerability
While Keycloak’s primary user-listing endpoint correctly enforced access controls—returning an empty response when queried by restricted administrators lacking the view-users privilege—the role-members endpoint did not apply the same per-user authorization checks. This oversight allowed restricted administrators to access user information through the role-members API, even when the main users endpoint denied such access.
This security flaw is classified under CWE-639 as a broken object-level authorization issue, commonly referred to as broken access control. It has been assigned a CVSS score of 6.5, categorizing it as a medium-severity vulnerability. Exploitation requires an authenticated administrator account with limited privileges, making it particularly relevant for organizations that delegate partial Keycloak administration to support teams or business units.
Technical Analysis and Remediation
The vulnerable code was located in the RoleContainerResource.getUsersInRole method, which fetched role members and converted them into user representations without verifying whether the caller was authorized to view each individual user. The patch introduced in Keycloak version 26.7.0 adds the necessary per-user visibility validation before returning user records.
It’s important to note that realms utilizing fine-grained admin permissions version 2 are not affected by this vulnerability, as filtering occurs at the data-store layer. The exposure primarily impacts deployments using the default permission model, where adminPermissionsEnabled is set to false.
Organizations are strongly advised to upgrade Keycloak to version 26.7.0 or later to mitigate this vulnerability. Additionally, administrators should review accounts assigned the query-users and view-realm roles, especially in multi-team environments, to ensure that access controls are appropriately configured.
This incident underscores the importance of consistent authorization checks across all API endpoints. Security teams should rigorously test sibling API endpoints to ensure they enforce the same access controls as primary routes, as a protected primary route does not guarantee that alternate paths are equally secure.
