CVE-2026-94213

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the Authorization Services component of Keycloak allows a delegated administrator with limited viewing privileges to access the full profile and role information of any user in the realm. This occurs at the policy evaluation endpoint, which administrators use to test access policy applications. The issue stems from missing authorization checks, potentially exposing sensitive data such as email addresses and assigned security roles.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.