Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-20T02:56:24 keycloak-services: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CWE-862

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess high-level administrative privileges within a specific client or resource server. Successful exploitation allows an attacker to view sensitive user profile information and role mappings that they are otherwise restricted from seeing. The vulnerability's root cause is a missing authorization check in the Authorization Services policy evaluation logic. Red Hat would like to thank Amr Al Hallak (v4yne1) and Maksim Hayder for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Keycloak Affected keycloak/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected keycloak-services Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-94213 https://nvd.nist.gov/vuln/detail/CVE-2026-94213