Security Flaw in Keycloak Exposes User Data
A serious vulnerability in Keycloak has come to light, enabling unauthorized administrator accounts to potentially access sensitive user information. This vulnerability, designated as CVE-2026-17059, impacts the Keycloak Admin REST API, revealing a significant risk to user privacy. The issue was identified by researcher Enzo Mongin from Escape Research, also known by the alias Orionexe.
The vulnerability, notably classified as a "broken object-level authorization issue" (CWE-639), holds a CVSS 3.1 score of 6.5, marking it as a medium severity concern. Reporting of the flaw was initiated on July 18, 2026, and received prompt acknowledgment from the Keycloak team on the same day. Red Hat officially assigned a CVE number to the issue by July 24, 2026, and the Keycloak team addressed and remedied the problem shortly thereafter, with a fix implemented in version 26.7.0 on July 28, 2026.
Understanding the Keycloak Vulnerability
The vulnerability lies within a specific endpoint utilized for listing members associated with a particular role:
GET /admin/realms/{realm}/roles/{role-name}/usersIn typical functioning, Keycloak’s user-listing endpoint employs a per-user authorization check prior to returning any user records. This means that a restricted administrator, who only holds permissions such as query-users and view-realm, would typically receive an empty response when attempting to access the main users API, effectively curtailing their ability to view sensitive user data.
However, Escape Research’s findings revealed a critical oversight: the role-members endpoint did not apply similar visibility filters. Specifically, the method RoleContainerResource.getUsersInRole was only verifying whether the requester had rights to view the role and to issue user queries. As a result, it granted unrestricted access to representation of users for every role member, irrespective of the requesting administrator’s access privileges.
Consequently, a restricted account—one that Keycloak would normally consider incapable of browsing the user directory—could exploit this vulnerability to extract user records through role membership queries.
Data at Risk
The compromised information may include:
- Usernames
- Email addresses
- First and last names
- Account enabled status
- Email verification status
In organizational frameworks where multiple teams or tenants utilize Keycloak, this vulnerability creates a substantial risk. Helpdesk or support administrators could maliciously—or inadvertently—enumerate personal data belonging to users across different teams, thereby breaching the intended separation of data.
Scope of Impact and Remediation Steps
This vulnerability predominantly affects realms utilizing Keycloak’s default administrative permission model, in which adminPermissionsEnabled is set to false. The permissions granted in this configuration—query-users and view-realm—represent a limited administrative setup often employed for streamlined support workflows and search functionalities.
Conversely, realms implementing fine-grained admin permissions version 2 are insulated from this flaw, as they filter role-member queries at the storage layer, thereby preventing unauthorized access to user data.
Escape Research successfully validated the presence of this vulnerability against a Keycloak build versioned 999.0.0-SNAPSHOT from the project’s main branch at commit 33695405ea.
To resolve this insecurity, the remediation process involves augmenting the role-member retrieval flow with a per-user canView authorization check before user records can be converted into API representations. This change serves to align the role-members endpoint with existing protections established in the main user-listing endpoint, enhancing the overall security framework.
Recommended Actions for Administrators
Administrators are urged to promptly upgrade their Keycloak instances to version 26.7.0 or later. Additionally, organizations should conduct thorough reviews of delegated administrative roles. They must identify which accounts have been granted query-users and view-realm permissions while assessing whether user information may have been compromised through access to the role-member API prior to applying the patch.
This incident serves as a poignant reminder of the critical importance of stringent access control measures in safeguarding user data within software solutions. Organizations are encouraged to remain vigilant and proactive in addressing vulnerabilities to protect their users and maintain trust in their systems.