CVE-2026-17059 in Keycloak
Summary
by MITRE • 07/24/2026
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within the keycloak-services library component of the Keycloak identity and access management platform, specifically affecting the role-users endpoint functionality. The flaw represents a critical authorization bypass issue that undermines the fundamental security principles of role-based access control. When administrators attempt to list members of a specific role through the affected endpoint, the system fails to perform proper permission validation checks before exposing user information. This technical shortcoming allows restricted administrative users to enumerate and access sensitive personal data including usernames and email addresses of individuals they should not have visibility into according to their assigned privileges.
The vulnerability manifests as an insufficient authorization check mechanism that operates at the application layer, specifically within the REST API endpoint handling role membership queries. According to CWE-862, this represents a weakness in authorization where the system fails to properly verify that an authenticated user has adequate permissions to access specific resources. The flaw directly violates the principle of least privilege and creates an information disclosure scenario where unauthorized users can gain knowledge about other system participants. This type of vulnerability falls under the ATT&CK technique T1213.001 for Data from Information Repositories, as it enables adversaries or compromised accounts to extract user data through legitimate administrative interfaces.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks including credential harvesting, social engineering campaigns, and targeted phishing attempts. An attacker with restricted administrator privileges could map out user populations within the system, identify key personnel, and gather intelligence for further exploitation. The exposure of email addresses and usernames creates additional attack vectors for password spraying, account takeover attempts, and other credential-based attacks. Organizations relying on Keycloak for identity management face significant risk of unauthorized data access and potential compromise of their entire authentication ecosystem.
Mitigation strategies should focus on implementing proper authorization checks at the endpoint level to ensure that administrators can only view users within their scope of authority. The fix requires modifying the role-users endpoint logic to validate administrative permissions against user access levels before returning any membership information. Organizations should also implement comprehensive monitoring and logging of administrative activities, particularly around role membership queries and user enumeration attempts. Regular security assessments and penetration testing should be conducted to identify similar authorization bypass vulnerabilities across the Keycloak deployment. Additionally, implementing proper audit trails and access controls for all administrative functions will help detect and prevent unauthorized data access attempts while maintaining compliance with information security standards and regulatory requirements.