CVE-2026-17059

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the role-users endpoint of the keycloak-services library. The system fails to verify if an administrator has the necessary permissions to view individual users when listing role members. This allows a restricted administrator to access private information, including names and email addresses, of users they are not authorized to see.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.