CVE-2026-17059: Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter
Vulnerability summary
CVE-2026-17059 is a medium (CVSS 6.5) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.9% of scored vulnerabilities.
Timeline
- 24-07-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
Decrease -0.08 pp
From 0.49% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat1 product
1 vendor · 1 product