CVE-2026-94213 in Keycloak
Summary
by MITRE • 09/21/2026
A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within Keycloak's Authorization Services component represents a critical failure in access control logic, specifically affecting the policy evaluation endpoint designed for administrative testing purposes. As an open-source identity and access management solution, Keycloak relies heavily on strict role-based and attribute-based access controls to ensure that users only interact with data appropriate to their assigned privileges. The flaw arises because this specific endpoint lacks sufficient authorization checks when processing requests from delegated administrators who possess limited viewing permissions. Instead of restricting the response payload to match the administrator's actual scope, the system erroneously returns comprehensive user profile details and role assignments for any target user within the realm. This behavior effectively bypasses the intended security boundaries established by the organization's identity governance policies, allowing a low-privilege actor to escalate their informational access significantly beyond what is permitted by standard operational guidelines.
From a technical perspective, this issue constitutes an Insecure Direct Object Reference combined with Broken Access Control vulnerabilities as defined in common vulnerability enumeration standards. The core defect lies in the server-side validation logic which fails to verify whether the requesting administrator has explicit permission to view the specific user's sensitive attributes before generating the response. By exposing full profile information and assigned security roles, the flaw enables unauthorized data aggregation that can be leveraged for further malicious activities. An attacker exploiting this weakness could map out the internal structure of an organization by identifying high-privilege accounts, such as those with administrative or super-user roles, simply by iterating through user identifiers in the policy evaluation tool. This information disclosure facilitates targeted phishing attacks, social engineering efforts, and potentially aids in lateral movement within a compromised network environment where Keycloak serves as the central authentication provider.
The operational impact of this vulnerability is substantial, particularly for enterprises relying on granular delegation models to distribute administrative duties among multiple teams or third-party vendors. The exposure of email addresses allows external threat actors to construct precise attack vectors against specific individuals, while the revelation of security roles provides a roadmap for privilege escalation attempts. If an attacker identifies users with elevated privileges through this flaw, they can focus their efforts on compromising those specific accounts rather than guessing randomly across the user base. This significantly reduces the effort required for subsequent attacks and increases the likelihood of successful intrusion into critical systems protected by Keycloak. Furthermore, such exposure may violate regulatory compliance requirements regarding data privacy and access logging, as sensitive personal identifiable information is disclosed to unauthorized parties without proper audit trails or consent mechanisms being triggered in a manner consistent with security best practices.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Organizations running affected versions of Keycloak should immediately apply the vendor-provided patch that corrects the authorization checks within the policy evaluation endpoint. Until patches are applied, administrators can mitigate risk by restricting access to this specific testing tool only to users with full administrative privileges, thereby ensuring that no delegated administrator with limited viewing rights can invoke the vulnerable function. Additionally, implementing strict input validation and enforcing least-privilege principles across all API endpoints is essential. Security teams should also enhance monitoring capabilities to detect unusual patterns of user profile requests originating from low-privilege accounts, which may indicate active exploitation attempts. Regular audits of delegated administrator permissions are recommended to ensure that the principle of least privilege is strictly maintained and that no excessive access rights have been inadvertently granted during routine administrative operations.