CVE-2026-17059 | A flaw was found in the role-users endpoint of the keycloak-… | CVSS 6.5 MEDIUM

Description

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.

Metadata

CVE ID: CVE-2026-17059
State: PUBLISHED
Assigner: redhat
Reserved: 2026-07-24 13:37 UTC
Published: 2026-07-24 14:06 UTC
Last updated: 2026-07-24 14:52 UTC
Primary CWE: CWE-639
Authorization Bypass Through User-Controlled Key
Vendor / Product: Red Hat / Red Hat Build of Keycloak
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (6)

Vendor	Product	Platform	Versions
Red Hat	Red Hat Build of Keycloak	—	—
Red Hat	Red Hat Build of Keycloak	—	—
Red Hat	Red Hat Build of Keycloak	—	—
Red Hat	Red Hat Data Grid 8	—	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—	—
Red Hat	Red Hat Single Sign-On 7	—	—

Weakness (CWE)

CWE	Source	Description
CWE-639	cna	Authorization Bypass Through User-Controlled Key

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (2)