AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-17059

Red Hat role-users endpoint: insecure direct object reference

Red Hat

CVE-2026-17059 · Published Jul 24, 2026 · updated Sep 16, 2026

Medium6.5
No fix yet
Red Hat advisory

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.

Affected versions

PackageAffectedFixed in
Red Hat Data Grid 8
Product
all versionsNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion Pack
Product
all versionsNo fix yet
Red Hat Single Sign-On 7
Product
all versionsNo fix yet
Red Hat build of Keycloak 26.6.7
Product
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
Details and references

More Red Hat advisories

All Red Hat