Keycloak CVE-2024-3700 Exposes User Data Across Admin Boundaries

Key Takeaways

• A critical broken access control vulnerability (CVE-2026-17059) was discovered in Keycloak.
• The flaw allowed restricted administrators to access sensitive user data, including usernames and email addresses, beyond their authorized scope.
• The vulnerability impacts Keycloak deployments using the default permission model, specifically affecting the Admin REST API.
• Red Hat issued a patch on July 28, 2026, with the release of Keycloak version 26.7.0.

Keycloak has recently patched a significant access control vulnerability that could have permitted administrators with limited privileges to view sensitive user information outside their designated scope. This flaw, identified as CVE-2026-17059, affected the Keycloak Admin REST API and was capable of exposing usernames, email addresses, and other profile details.

The discovery of this issue is credited to Enzo Mongin, also known as Orionexe, a researcher at Escape. Red Hat officially acknowledged the vulnerability on July 24, 2026, and a remediation was subsequently deployed on July 28 with the release of Keycloak version 26.7.0.

Technical Details of the Vulnerability

The vulnerability resided within a specific endpoint of the Keycloak Admin REST API, used for listing members assigned to a particular role:

GET /admin/realms/{realm}/roles/{role-name}/users

An administrator account, even one restricted to only query-users and view-realm permissions, could exploit this endpoint. By invoking this API, such an account could retrieve complete user records for individuals associated with roles they were authorized to view. The data exposed included usernames, email addresses, first and last names, account status, and email verification status.

Escape found that while Keycloak correctly secured its primary user-listing endpoint, returning an empty response for restricted administrators lacking view-users privileges, the role-members endpoint operated differently. This particular endpoint only enforced broad role-viewing and user-query permissions, failing to apply the granular per-user authorization filters present elsewhere.

Consequently, the same authentication token that would yield no results from the main users API could successfully extract personal data via the role-members API. This disparity introduced a significant privacy risk, especially in shared Keycloak realms where certain administrative accounts, such as those used by helpdesk personnel, are intentionally designed to have restricted access to the full user directory.

The flaw is categorized as broken object-level authorization, a specific type of broken access control under CWE-639. It has been assigned a CVSS score of 6.5, placing it in the Medium severity category. Exploitation of this vulnerability necessitates an authenticated, albeit intentionally limited, administrator account. This makes it particularly pertinent for organizations that delegate partial Keycloak administration responsibilities to support teams or distinct business units.

The vulnerable code segment was identified within RoleContainerResource.getUsersInRole. This function retrieved role members and directly converted them into user representations without adequately verifying if the calling administrator was authorized to view each individual user. The patch introduces the necessary per-user visibility validation before any user records are returned. It is important to note that Keycloak realms utilizing fine-grained admin permissions version 2 are not affected, as their filtering mechanisms operate at the data-store layer. The vulnerability primarily impacted deployments that relied on the default permission model, where adminPermissionsEnabled is set to false.

What You Should Do

• Organizations should immediately upgrade their Keycloak instances to version 26.7.0 or a later release to implement the official patch.
• Administrators should conduct a thorough review of all accounts assigned the query-users and view-realm roles, particularly in multi-team or delegated administration environments.
• Security teams are advised to routinely test sibling API endpoints for consistent authorization behavior, as robust protection on a primary route does not guarantee equivalent access controls on alternative paths.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.