CVE-2026-17059
Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jul 24, 2026
- Updated
- Sep 16, 2026
- Reserved
- Jul 24, 2026
Description
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6.7Red Hat | |
Red Hat build of Keycloak 26.6.7Red Hat | |
Red Hat build of Keycloak 26.6.7Red Hat | |
Red Hat Data Grid 8Red Hat | |
Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat | |
Red Hat Single Sign-On 7Red Hat |
References
- RHSA-2026:68277vendor-advisory
- RHSA-2026:68278vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-17059vdb-entry
- RHBZ#2506746issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.