Executive brief
Keycloak is an open-source identity and access management solution used to secure applications and services. A security flaw allows administrators with limited permissions to bypass profile restrictions and view sensitive user information they are not authorized to see. This could lead to the exposure of private user attributes, potentially compromising user privacy or organizational data policies.
Technical details
An information disclosure vulnerability exists in org.keycloak.services due to insufficient granularity of access control (CWE-1220). An administrator with delegated permissions to read group memberships and users can bypass configured user profile permissions by querying the group members endpoint. This allows the attacker to retrieve user attributes that are explicitly configured to be denied or hidden. The attack requires high privileges (delegated admin access) and is reachable over the network without user interaction. The issue is resolved in Keycloak version 26.7.0 and various Red Hat build of Keycloak maintenance releases.
Affected products
- Keycloak Keycloak < 26.7.0
- Red Hat Red Hat build of Keycloak 26.6 < 26.6.3-3
- Red Hat Red Hat build of Keycloak 26.4 < 26.4.13-1
Timeline
- 2026-05-20: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-05: advisory: GitHub Advisory and NVD entry published
- 2026-06-10: patched: Red Hat released security advisories for patched versions