Executive brief
Keycloak, an open-source identity and access management solution, contains a flaw in its user lookup functionality. An authenticated user with minimal permissions can exploit this to view the private profile information of any other user in the system. This could lead to the large-scale harvesting of sensitive personal data, such as names and email addresses, potentially damaging an organization's reputation and violating privacy regulations.
Technical details
A broken access control vulnerability (CWE-1220) exists in Keycloak's Account Resources user lookup endpoint. The root cause is insufficient granularity in access control checks; specifically, any remote authenticated user who owns at least one User-Managed Access (UMA) resource can query the endpoint. By sending crafted requests with arbitrary usernames or email values, an attacker can bypass intended restrictions to retrieve full profile objects for unrelated users across the entire realm. This allows for broad profile-level information disclosure. Patches are available in versions 26.4.12 and 26.6.2.
Affected products
- Keycloak Keycloak < 26.4.12, >= 26.5.0, < 26.6.2
Timeline
- 2026-05-19: disclosed
- 2026-05-19: advisory
- 2026-06-30: other: Advisory updated