Threat reportVulnerabilityTL-2026-1796
CVE-2026-17059: Keycloak Admin REST API Broken Object-Level Authorization Exposes User PII
CVE-2026-17059 (TL-2026-1796) is a medium-severity software vulnerability scored CVSS 6.5, first published 2026-07-31. It has no confirmed attribution, affects Keycloak Keycloak (keycloak-services), references 6 CVEs (CVE-2026-17059, CVE-2024-3656, CVE-2025-14082), maps to 12 MITRE ATT&CK techniques (T1048, T1069, T1078), and is covered by 9 detection rules and 26 indicators of compromise.
- CVSS
- 6.5/10Medium
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-1796
- Threat ID
- TL-2026-1796
- Severity
- MEDIUM
- CVSS
- 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, enterprise-software, finance, health, government administration, education, software-as-a-service
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
How CVE-2026-17059 works
A broken object-level authorization flaw (CWE-639) in Keycloak's Admin REST API role-members endpoint (GET /admin/realms/{realm}/roles/{role-name}/users) lets a restricted administrator holding only query-users and view-realm permissions enumerate other users' usernames, emails, names, and account-status fields by bypassing the per-user visibility filter the main users endpoint enforces. Fixed in Keycloak 26.7.0; not exploited in the wild.
CVE-2026-17059 is a broken object-level authorization (BOLA, CWE-639) vulnerability in the role-members listing endpoint of Keycloak's Admin REST API, GET /admin/realms/{realm}/roles/{role-name}/users, implemented in org.keycloak.services.resources.admin.RoleContainerResource. The vulnerable code path (referred to as getUsersInRole in vendor write-ups and as getRoleUserMembers in the Red Hat tracking bug) verified only that the caller could view the role and issue user queries, then returned full user representations without applying the per-user canView visibility filter that the primary /admin/realms/{realm}/users listing endpoint already enforces.
As a result, an authenticated but deliberately restricted administrator holding only the query-users and view-realm admin roles -- and explicitly lacking the broader view-users permission -- can call the role-members endpoint for any role in the realm and receive complete user objects: usernames, email addresses, first/last names, account-enabled status, and email-verification status for every user assigned to that role. This is a textbook multi-tenant/helpdesk-privilege-abuse pattern: organizations that delegate narrow, role-scoped admin duties (e.g. a helpdesk operator who should only be able to see who holds a support role) inadvertently grant that operator a path to enumerate PII for the realm's full user population tied to any role, including roles the operator was never meant to have visibility into.
CVSS 3.1 base score is 6.5 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N -- network-exploitable, low complexity, requiring only low (restricted-admin) privileges, no user interaction, with a high confidentiality impact and no integrity or availability impact. Realms using Fine-Grained Admin Permissions v2 (FGAP v2) are not affected, since FGAP v2 applies its own object-level checks independent of the legacy role path. The flaw affects Keycloak's keycloak-services component and Red Hat build of Keycloak (rhbk-keycloak-rhel9, rhbk-openshift-rhel9); Red Hat Data Grid 8, Red Hat JBoss EAP Expansion Pack, and Red Hat Single Sign-On 7 are explicitly not affected.
Security researcher Enzo Mongin (aka Orionexe) of Escape Research discovered and reported the flaw on 2026-07-18; the Keycloak security team acknowledged it the same day. CVE-2026-17059 was publicly assigned on 2026-07-24 (Red Hat Bugzilla 2506746 opened the same day), and the vendor confirmed the fix on 2026-07-28, adding a per-user canView authorization check to the role-member retrieval path before user data is converted to a response. GBHackers' coverage credits Keycloak 26.7.0 as the fixed release; that release's own notes (GA 2026-07-09 per the official Keycloak blog) enumerate a cluster of other Admin API access-control fixes shipped in the same train (CVE-2026-9796 admin-role-rename TOCTOU, CVE-2026-9689 OIDC redirect-URI HTTP parameter pollution, CVE-2026-9798 CIBA brute-force-lockout bypass, CVE-2026-11986 FGAP v1 role-unassignment gap, plus organization-endpoint and SSF admin-endpoint authorization hardening), indicating this disclosure landed in the middle of a broader Keycloak admin-API access-control hardening cycle.
This is not an isolated defect: Keycloak's Admin REST API has a recurring history of object/attribute-level authorization gaps in exactly this shape -- CVE-2025-14082 let query-groups-only admins enumerate full realm role metadata; CVE-2026-9791 let any organization member read organization metadata via the account API/OIDC token even after an admin disabled the Organizations feature; CVE-2024-3656 let any authenticated user invoke the administrative testLDAPConnection action; and CVE-2026-16105 involves a separate authorization gap in the very same RoleContainerResource.java class (composite-role removal from built-in admin roles). No public PoC and no evidence of active/in-the-wild exploitation have been reported for CVE-2026-17059, and it does not appear in the CISA KEV catalog; the primary risk is silent, low-noise PII enumeration by an already-trusted-but-restricted internal administrator (or a compromised low-privilege admin account) rather than remote unauthenticated compromise.
MITRE ATT&CK techniques used in TL-2026-1796
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery
Initial Access
Privilege Escalation
Defense Evasion
Credential Access
Collection
T1119 Automated Collection; T1213 Data from Information Repositories; T1602 Data from Configuration Repository
Impact
Persistence
T1556 Modify Authentication Process
Reconnaissance
T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information
Affected products and versions in CVE-2026-17059
- Keycloak — Keycloak (keycloak-services)
Vulnerable versions: < 26.7.0
Fixed in: 26.7.0 - Red Hat — Red Hat build of Keycloak
Vulnerable versions: rhbk-keycloak-rhel9 prior to fix; rhbk-openshift-rhel9 prior to fix
Fixed in: patched RHBK builds per Red Hat advisory tracked in Bugzilla 2506746
Remediation for CVE-2026-17059
Patches
- Apply Keycloak 26.7.0, which adds a per-user canView authorization check to the role-member retrieval path in RoleContainerResource before user representations are returned
Immediate actions
- Upgrade all Keycloak and Red Hat build of Keycloak instances to 26.7.0 or later (or the corresponding RHBK patch release)
- Audit restricted-admin role assignments that combine query-users with view-realm while withholding view-users, and revoke or tighten them until patched
- Review Keycloak admin audit logs for GET /admin/realms/{realm}/roles/{role-name}/users calls made by non-full-admin accounts, especially high-volume/paginated calls consistent with bulk enumeration
Workarounds
- Until patched, avoid granting the query-users + view-realm permission pair without also granting/gating on view-users
- Monitor and alert on role-members endpoint access by restricted admin accounts as a compensating control
Longer-term hardening
- Migrate realms to Fine-Grained Admin Permissions v2 (FGAP v2), which is not affected by this flaw and applies consistent object-level checks
- Re-review least-privilege delegated-admin role design after each Keycloak Admin REST API CVE, given the recurring pattern seen in CVE-2025-14082, CVE-2026-9791, and CVE-2026-16105
- Add automated regression tests asserting the per-user canView visibility filter is applied on every admin listing endpoint, not just the primary users endpoint
CVEs associated with CVE-2026-17059
CVE-2026-17059, CVE-2024-3656, CVE-2025-14082, CVE-2026-16103, CVE-2026-9791, CVE-2026-9798
Weaknesses (CWE) in CVE-2026-17059
Timeline of CVE-2026-17059
- CVE-2025-14082 (role_query-groups permission discloses full realm role metadata -- names, IDs, composite status, container IDs -- enabling privilege-structure mapping) is publicly disclosed, the earliest in the recurring pattern of Keycloak Admin REST API object/attribute-level authorization gaps that CVE-2026-17059 continues; fixed in 26.4.11/26.5.6/26.6.0.
- CVE-2026-9791 is published: an authenticated organization member can request OIDC tokens with the 'organization' scope and obtain organization metadata even after an administrator disables the Organizations feature entirely, undermining that admin control.
- CVE-2026-9791's advisory is reviewed and last updated ahead of the Keycloak 26.6.3 fix release.
- Keycloak 26.7.0 reaches general availability (per the official Keycloak blog); the release bundles the role-members per-user canView fix (CVE-2026-17059) with a cluster of other Admin API access-control hardening fixes: CVE-2026-9796 (admin-role-rename TOCTOU realm-wide escalation), CVE-2026-9689 (OIDC redirect-URI HTTP parameter pollution), CVE-2026-9798 (CIBA flow brute-force account-lockout bypass), CVE-2026-11986 (FGAP v1 arbitrary role unassignment), plus organization-endpoint FGAP filtering gaps, SSF admin-endpoint secret exposure, Admin API v2 Secret-ownership bypass, and identity-broker error-message leakage.
- Keycloak maintainers acknowledge the report the same day it is submitted.
- Enzo Mongin (Orionexe) of Escape Research reports the role-members broken object-level authorization flaw to the Keycloak security team.
- CVE-2026-17059 is publicly assigned and published in NVD with a CVSS 3.1 base score of 6.5; Red Hat opens Bugzilla tracking bug 2506746 for keycloak-services at 13:38 UTC, describing the root cause as RoleResource.getRoleUserMembers failing to apply the per-user view filter.
- Vendor confirms the fix is released, adding a per-user canView authorization check to the role-member retrieval path (RoleContainerResource / RoleResource.getRoleUserMembers) before user representations are returned.
- Threadlinqs OSINT hunt pipeline ingests GBHackers' coverage of the disclosure and opens threat tracking as TL-2026-1796.
Sources cited for CVE-2026-17059
- Keycloak Flaw Exposes Users' Personal Data
- CVE-2026-17059 Detail - NVD
- CVE-2026-17059 - Red Hat Customer Portal
- Bug 2506746 - CVE-2026-17059 keycloak-services: role-users endpoint missing per-user authorization filter
- Release 26.7.0 - keycloak/keycloak
- Keycloak 26.7.0 released
- CVE-2025-14082 keycloak-server: Keycloak Admin REST API Improper Access Control leads to sensitive role metadata information disclosure
- CVE-2026-9791 - Keycloak Vulnerable to Incorrect Authorization
- CVE-2026-9798 Detail - NVD
- Bug 2501736 - CVE-2026-16103 keycloak-services: incomplete fix for CIBA brute-force lockout bypass at token redemption
- CVE-2024-3656 - Keycloak's admin API allows low privilege users to use administrative functions
- Keycloak 26.6.3 released
Detection coverage for TL-2026-1796
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1796 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.