Medium [CVE-2026-17059] Information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role.

This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess a restricted administrator account.

Successful exploitation allows an attacker to disclose sensitive personal identifiable information PII of users within the realm that they are otherwise restricted from viewing. The vulnerabilitys root cause is a missing authorization check on the role-users API endpoint.

Weakness: CWE-639. Affected Red Hat products: Red Hat Build of Keycloak.

Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.