Keycloak Patches Broken Access Control Flaw Exposing User Data Keycloak has resolved a broken access control vulnerability (CVE-2026-17059) that allowed restricted administrators to access sensitive user data including usernames, email addresses, and profile details outside their authorized scope. The flaw, discovered by Escape researcher Enzo Mongin (Orionexe), affected the Keycloak Admin REST API and was disclosed by Red Hat on July 24, 2026. The issue stemmed from the `GET /admin/realms/{realm}/roles/{role-name}/users` endpoint, which failed to enforce proper per-user authorization checks. While Keycloak’s primary user-listing API correctly blocked restricted admins from viewing all users, the role-members endpoint only required `query-users` and `view-realm` permissions, allowing unauthorized access to full user records. The vulnerability, classified as CWE-639 (Broken Object-Level Authorization), carries a CVSS score of 6.5 (Medium). Exploitation required an authenticated but limited admin account, posing risks in environments where partial administrative access is delegated to support teams or business units. Keycloak addressed the flaw in version 26.7.0 (released July 28, 2026) by adding per-user visibility validation before returning records. The fix does not affect realms using fine-grained admin permissions (v2), where filtering occurs at the data-store layer. However, deployments with `adminPermissionsEnabled` set to false remain vulnerable. Organizations are advised to upgrade to Keycloak 26.7.0 or later and review accounts with `query-users` and `view-realm` roles, particularly in multi-team setups. Security teams should also audit related API endpoints to ensure consistent authorization enforcement.