Keycloak has fixed a broken access control flaw that lets restricted administrators access users' usernames, emails, and other profile details from outside their scope. This issue was identified as CVE-2026-17059, affecting the Keycloak Admin REST API and was found by Escape researcher Enzo Mongin, known as Orionexe. The vulnerability is present in the endpoint used to list users assigned to a specific role: GET /admin/realms/{realm}/roles/{role-name}/users A restricted administrator can call this endpoint and obtain full user records for roles they are authorized to view.
Consequently, a token that previously returned an empty list from the main users endpoint could now retrieve sensitive information through the role-members API.
Exploitation necessitates an authenticated but limited administrator account, making it particularly significant for organizations that delegate partial Keycloak administration to support teams or business units. The vulnerable code path was found in RoleContainerResource.getUsersInRole, which fetched role members and directly converted them into user representations without verifying the caller's authorization to view each individual user. Security teams should test sibling API endpoints for consistent authorization behavior, as a protected primary route does not ensure that alternate paths enforce the same access controls.
