Keycloak Patches Broken Access Control Flaw Exposing User Data
Keycloak has resolved a broken access control vulnerability (CVE-2026-17059) that allowed restricted administrators to access sensitive user data including usernames, email addresses, and profile details outside their authorized scope. The flaw, discovered by Escape researcher Enzo Mongin (Orionexe), affected the Keycloak Admin REST API and was disclosed by Red Hat on July 24, 2026.
The issue stemmed from the GET /admin/realms/{realm}/roles/{role-name}/users endpoint, which failed to enforce proper per-user authorization checks. While Keycloak’s primary user-listing API correctly blocked restricted admins from viewing all users, the role-members endpoint only required query-users and view-realm permissions, allowing unauthorized access to full user records.
The vulnerability, classified as CWE-639 (Broken Object-Level Authorization), carries a CVSS score of 6.5 (Medium). Exploitation required an authenticated but limited admin account, posing risks in environments where partial administrative access is delegated to support teams or business units.
Keycloak addressed the flaw in version 26.7.0 (released July 28, 2026) by adding per-user visibility validation before returning records. The fix does not affect realms using fine-grained admin permissions (v2), where filtering occurs at the data-store layer. However, deployments with adminPermissionsEnabled set to false remain vulnerable.
Organizations are advised to upgrade to Keycloak 26.7.0 or later and review accounts with query-users and view-realm roles, particularly in multi-team setups. Security teams should also audit related API endpoints to ensure consistent authorization enforcement.
Source: https://cybersecuritynews.com/keycloak-vulnerability/
Phase Two, Inc cybersecurity rating report: https://www.rankiteo.com/company/phase-two-keycloak
"id": "PHA1785522523",
"linkid": "phase-two-keycloak",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Identity and Access Management (IAM)',
'name': 'Keycloak',
'type': 'Software'}],
'attack_vector': 'Admin REST API Endpoint',
'customer_advisories': 'Organizations are advised to upgrade to Keycloak '
'26.7.0 or later and review accounts with '
'`query-users` and `view-realm` roles.',
'data_breach': {'personally_identifiable_information': 'Usernames, email '
'addresses, profile '
'details',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII)'},
'date_publicly_disclosed': '2026-07-24',
'date_resolved': '2026-07-28',
'description': 'Keycloak has resolved a broken access control vulnerability '
'(CVE-2026-17059) that allowed restricted administrators to '
'access sensitive user data including usernames, email '
'addresses, and profile details outside their authorized '
'scope. The flaw affected the Keycloak Admin REST API and was '
'disclosed by Red Hat on July 24, 2026. The issue stemmed from '
'the `GET /admin/realms/{realm}/roles/{role-name}/users` '
'endpoint, which failed to enforce proper per-user '
'authorization checks. Exploitation required an authenticated '
'but limited admin account, posing risks in environments where '
'partial administrative access is delegated to support teams '
'or business units.',
'impact': {'data_compromised': 'Usernames, email addresses, profile details',
'identity_theft_risk': 'High',
'systems_affected': 'Keycloak Admin REST API'},
'investigation_status': 'Resolved',
'lessons_learned': 'Organizations should ensure consistent authorization '
'enforcement across all API endpoints, particularly in '
'multi-team setups where partial administrative access is '
'delegated. Deployments with `adminPermissionsEnabled` set '
'to false remain vulnerable and require immediate '
'patching.',
'post_incident_analysis': {'corrective_actions': 'Added per-user visibility '
'validation before returning '
'records in Keycloak 26.7.0. '
'Fine-grained admin '
'permissions (v2) are '
'unaffected as filtering '
'occurs at the data-store '
'layer.',
'root_causes': 'Failure to enforce proper per-user '
'authorization checks in the `GET '
'/admin/realms/{realm}/roles/{role-name}/users` '
'endpoint. Only `query-users` and '
'`view-realm` permissions were '
'required, allowing unauthorized '
'access to full user records.'},
'recommendations': 'Upgrade to Keycloak 26.7.0 or later. Review and restrict '
'accounts with `query-users` and `view-realm` roles. Audit '
'related API endpoints for proper authorization checks.',
'references': [{'source': 'Red Hat Security Advisory'},
{'source': 'Escape Research (Enzo Mongin)'}],
'response': {'containment_measures': 'Patch released in Keycloak version '
'26.7.0',
'enhanced_monitoring': 'Audit related API endpoints for '
'consistent authorization enforcement',
'remediation_measures': 'Upgrade to Keycloak 26.7.0 or later; '
'review accounts with `query-users` and '
'`view-realm` roles'},
'title': 'Keycloak Patches Broken Access Control Flaw Exposing User Data',
'type': 'Broken Access Control',
'vulnerability_exploited': 'CVE-2026-17059 (CWE-639: Broken Object-Level '
'Authorization)'}