Keycloak Vulnerability Allows Restricted Admins to Access Sensitive User Data
A broken access control flaw in Keycloak's Admin REST API, CVE-2026-17059, enables restricted administrators to view usernames and email addresses outside their authorized scope.
Keycloak has released version 26.7.0 to address a critical broken access control vulnerability, identified as CVE-2026-17059, that could permit restricted administrators to access sensitive user information beyond their designated permissions. The vulnerability, discovered by Enzo Mongin of Escape, impacts the Keycloak Admin REST API and specifically affects how role members are queried.
The flaw resides in the endpoint designed to list users associated with a specific role: GET /admin/realms/{realm}/roles/{role-name}/users. While a restricted administrator might possess permissions to query users and view realm details, they would typically be prevented from accessing individual user profiles. However, this specific endpoint failed to enforce the same granular, per-user authorization checks that are applied to the primary user-listing API. Consequently, an attacker with a limited administrative token could exploit this oversight to retrieve full user records, including usernames, email addresses, first and last names, account status, and email verification status.
This vulnerability is particularly concerning for organizations that utilize shared Keycloak realms or delegate administrative tasks to helpdesk-style support teams. In such scenarios, where administrators are intentionally granted limited access to prevent broad data exposure, this flaw bypasses those safeguards. The issue is classified as broken object-level authorization (CWE-639) and carries a CVSS score of 6.5, categorizing it as Medium severity. The risk is amplified in environments where administrative roles are distributed across multiple teams or business units.
Escape's research highlighted that while Keycloak's main user API correctly returned empty results for unauthorized queries, the role-members endpoint did not apply the same filtering logic. This inconsistency allowed the same token that was denied access to the general user directory to successfully retrieve detailed user information when querying role memberships. This discrepancy underscores the importance of consistent authorization enforcement across all API endpoints, even those not considered primary access points.
The vulnerability primarily affects deployments using Keycloak's default permission model, where the adminPermissionsEnabled setting is set to false. Realms configured with fine-grained admin permissions (version 2) are not susceptible, as authorization is enforced at the data-store layer. The fix implemented in Keycloak 26.7.0 introduces the necessary per-user visibility validation, ensuring that user records are only returned if the querying administrator has the explicit permission to view that specific user's data.
Organizations running Keycloak are strongly advised to upgrade to version 26.7.0 or a later release as soon as possible. Beyond patching, security teams should conduct a thorough review of accounts assigned the query-users and view-realm roles, especially in multi-tenant or delegated administration environments. It is also recommended to audit other sibling API endpoints to ensure consistent authorization controls are in place, as a secure primary endpoint does not guarantee the security of alternative access paths.
This incident serves as a reminder that even seemingly minor API endpoints can harbor significant security risks if access controls are not uniformly applied. The ability for restricted administrators to inadvertently access sensitive data highlights the ongoing challenge of maintaining robust authorization in complex identity and access management systems.