# CVE-2026-17059: Keycloak Admin REST API Broken Object-Level Authorization Exposes User PII

> A broken object-level authorization flaw (CWE-639) in Keycloak's Admin REST API role-members endpoint (GET /admin/realms/{realm}/roles/{role-name}/users) lets a restricted administrator holding only query-users and view-realm permissions enumerate other users' usernames, emails, names, and account-status fields by bypassing the per-user visibility filter the main users endpoint enforces. Fixed in Keycloak 26.7.0; not exploited in the wild.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1796
- **ID:** TL-2026-1796
- **Severity:** MEDIUM (CVSS 6.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-17059, CVE-2024-3656, CVE-2025-14082, CVE-2026-16103, CVE-2026-9791, CVE-2026-9798

## Description

CVE-2026-17059 is a broken object-level authorization (BOLA, CWE-639) vulnerability in the role-members listing endpoint of Keycloak's Admin REST API, GET /admin/realms/{realm}/roles/{role-name}/users, implemented in org.keycloak.services.resources.admin.RoleContainerResource. The vulnerable code path (referred to as getUsersInRole in vendor write-ups and as getRoleUserMembers in the Red Hat tracking bug) verified only that the caller could view the role and issue user queries, then returned full user representations without applying the per-user canView visibility filter that the primary /admin/realms/{realm}/users listing endpoint already enforces.

As a result, an authenticated but deliberately restricted administrator holding only the query-users and view-realm admin roles -- and explicitly lacking the broader view-users permission -- can call the role-members endpoint for any role in the realm and receive complete user objects: usernames, email addresses, first/last names, account-enabled status, and email-verification status for every user assigned to that role. This is a textbook multi-tenant/helpdesk-privilege-abuse pattern: organizations that delegate narrow, role-scoped admin duties (e.g. a helpdesk operator who should only be able to see who holds a support role) inadvertently grant that operator a path to enumerate PII for the realm's full user population tied to any role, including roles the operator was never meant to have visibility into.

CVSS 3.1 base score is 6.5 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N -- network-exploitable, low complexity, requiring only low (restricted-admin) privileges, no user interaction, with a high confidentiality impact and no integrity or availability impact. Realms using Fine-Grained Admin Permissions v2 (FGAP v2) are not affected, since FGAP v2 applies its own object-level checks independent of the legacy role path. The flaw affects Keycloak's keycloak-services component and Red Hat build of Keycloak (rhbk-keycloak-rhel9, rhbk-openshift-rhel9); Red Hat Data Grid 8, Red Hat JBoss EAP Expansion Pack, and Red Hat Single Sign-On 7 are explicitly not affected.

Security researcher Enzo Mongin (aka Orionexe) of Escape Research discovered and reported the flaw on 2026-07-18; the Keycloak security team acknowledged it the same day. CVE-2026-17059 was publicly assigned on 2026-07-24 (Red Hat Bugzilla 2506746 opened the same day), and the vendor confirmed the fix on 2026-07-28, adding a per-user canView authorization check to the role-member retrieval path before user data is converted to a response. GBHackers' coverage credits Keycloak 26.7.0 as the fixed release; that release's own notes (GA 2026-07-09 per the official Keycloak blog) enumerate a cluster of other Admin API access-control fixes shipped in the same train (CVE-2026-9796 admin-role-rename TOCTOU, CVE-2026-9689 OIDC redirect-URI HTTP parameter pollution, CVE-2026-9798 CIBA brute-force-lockout bypass, CVE-2026-11986 FGAP v1 role-unassignment gap, plus organization-endpoint and SSF admin-endpoint authorization hardening), indicating this disclosure landed in the middle of a broader Keycloak admin-API access-control hardening cycle.

This is not an isolated defect: Keycloak's Admin REST API has a recurring history of object/attribute-level authorization gaps in exactly this shape -- CVE-2025-14082 let query-groups-only admins enumerate full realm role metadata; CVE-2026-9791 let any organization member read organization metadata via the account API/OIDC token even after an admin disabled the Organizations feature; CVE-2024-3656 let any authenticated user invoke the administrative testLDAPConnection action; and CVE-2026-16105 involves a separate authorization gap in the very same RoleContainerResource.java class (composite-role removal from built-in admin roles). No public PoC and no evidence of active/in-the-wild exploitation have been reported for CVE-2026-17059, and it does not appear in the CISA KEV catalog; the primary risk is silent, low-noise PII enumeration by an already-trusted-but-restricted internal administrator (or a compromised low-privilege admin account) rather than remote unauthenticated compromise.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1589 Gather Victim Identity Information
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1602 Data from Configuration Repository
- T1110 Brute Force
- T1556 Modify Authentication Process
- T1048 Exfiltration Over Alternative Protocol
- T1531 Account Access Removal

## Sources

- [Keycloak Flaw Exposes Users' Personal Data](https://gbhackers.com/keycloak-flaw-exposes-users-personal-data/)
- [CVE-2026-17059 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-17059)
- [CVE-2026-17059 - Red Hat Customer Portal](https://access.redhat.com/security/cve/CVE-2026-17059)
- [Bug 2506746 - CVE-2026-17059 keycloak-services: role-users endpoint missing per-user authorization filter](https://bugzilla.redhat.com/show_bug.cgi?id=2506746)
- [Release 26.7.0 - keycloak/keycloak](https://github.com/keycloak/keycloak/releases/tag/26.7.0)
- [Keycloak 26.7.0 released](https://www.keycloak.org/2026/07/keycloak-2670-released)
- [CVE-2025-14082 keycloak-server: Keycloak Admin REST API Improper Access Control leads to sensitive role metadata information disclosure](https://github.com/keycloak/keycloak/issues/45653)
- [CVE-2026-9791 - Keycloak Vulnerable to Incorrect Authorization](https://github.com/advisories/GHSA-4q93-v92x-p89f)
- [CVE-2026-9798 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-9798)
- [Bug 2501736 - CVE-2026-16103 keycloak-services: incomplete fix for CIBA brute-force lockout bypass at token redemption](https://bugzilla.redhat.com/show_bug.cgi?id=2501736)
- [CVE-2024-3656 - Keycloak's admin API allows low privilege users to use administrative functions](https://github.com/advisories/GHSA-2cww-fgmg-4jqc)
- [Keycloak 26.6.3 released](https://www.keycloak.org/2026/06/keycloak-2663-released)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1796