Authorization Bypass in Keycloak Exposes User Data

Executive Summary

CVE-2026-94213 is an information disclosure vulnerability in Keycloak's Authorization Services policy evaluation endpoint. A delegated administrator with limited privileges can access full user profile and role information of any user in the realm by exploiting missing authorization checks in the endpoint. This allows exposure of sensitive data like email addresses and security roles.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak's Authorization Services policy evaluation endpoint for unauthorized access attempts. Check logs for requests to the endpoint with userId parameters from delegated administrators lacking view-users permissions. Look for responses containing sensitive user data like email addresses or role mappings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with administrative access to read sensitive user data such as email addresses, full names, and role assignments for any user in the realm. Exploitation could lead to unauthorized access to confidential information or resources, potentially causing further security breaches or compliance violations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal data, violating GDPR's data protection principles and HIPAA's privacy rules. Exposure of sensitive user information may result in regulatory fines, legal liabilities, and loss of trust due to non-compliance with data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak patches immediately. Restrict access to the policy evaluation endpoint by reviewing and tightening permissions for delegated administrators. Remove unnecessary administrative privileges and monitor for suspicious activity in the Authorization Services component.

Useful 0 Not Useful 0