A newly disclosed vulnerability in Keycloak, an open-source identity and access management server used by Red Hat, allows a restricted admin account to steal users' personal information through an unintended query of role membership rather than the primary user directory This article explores disclosed vulnerability keycloak. . Keycloak Flaw Exposes User Data GET /admin/realms/{realm}/roles/{role-name}/users, which lists a role’s members, only verifies that the caller can view the role and perform generic user queries.
The issue was confirmed end-to-end on a live Keycloak 999.0.0-SNAPSHOT build at commit 33695405ea, and it can be reproduced with just two API calls from a single restricted token; the severity is medium, with an CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Escape’s team highlights that the flaw was discovered automatically during testing of every user-returning endpoint, ensuring any identity denied by the canonical users list should be denied everywhere. Organizations using self-hosted Keycloak or Red Hat’s build are advised to upgrade to version 26.7.0 immediately, particularly if admin accounts possess narrowly scoped permissions without full visibility.
