Description

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-21T07:16:54.163Z",
  "pubdate": "2026-09-21T07:16:54.163Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw within the Authorization Services component of Keycloak. The defect resides in the policy evaluation endpoint, which is designed to allow administrators to simulate policy enforcement against specific users. Due to a failure in validating the requester's permissions against the target user's scope, an authenticated attacker with limited delegated administrator privileges can circumvent access control restrictions. The vulnerability allows unauthorized retrieval of PII and security metadata, including full user profiles, email addresses, and assigned roles, even for users outside the attacker's administrative domain. The impact is significant, as it facilitates information disclosure and potential privilege escalation vectors by revealing the security architecture and user configuration of the targeted realm. Exploitation requires authenticated access with delegated administration rights; no complex interaction or prior configuration changes are necessary beyond invoking the evaluation endpoint with an arbitrary target user identifier.",
  "technicalDetails": "The root cause of this vulnerability is a missing authorization check within the policy evaluation logic of the Authorization Services component in Keycloak. The policy evaluation endpoint is intended to assist administrators in debugging and testing authorization policies by allowing them to simulate access requests. During the evaluation process, the application logic fails to verify if the authenticated administrator requesting the simulation has the necessary `view-users` or equivalent administrative permission for the specific user being queried.\nThe attack flow proceeds as follows: 1) An attacker authenticates to the Keycloak instance with a delegated administrative role, which typically restricts their access to specific management scopes. 2) The attacker identifies the target user’s identifier (UUID) within the realm. 3) The attacker crafts a request to the policy evaluation endpoint, specifying the target user's context. 4) The backend service processes the request without validating the attacker's authorization scope against the target user. 5) The server returns a JSON response containing the target user's full profile, which includes sensitive attributes such as email addresses, identities, and assigned roles.\nBecause the policy evaluation engine requires full user context to accurately determine if a policy grants or denies access, it retrieves the complete user object from the underlying identity store. The vulnerability occurs because the interface providing this evaluation functionality does not enforce the same access control checks as the standard user management API. Consequently, the endpoint acts as a confused deputy, where the application’s privilege to access user data is misused by the unauthorized administrator. This behavior results in a high-fidelity information disclosure of the identity provider's directory.\nThe exploitation is trivial and does not require complex payloads; it simply relies on supplying the correct parameters to the endpoint. The post-exploitation impact includes the systematic harvesting of user data, which can be leveraged for reconnaissance, targeted phishing, or identifying accounts with higher-level privileges for subsequent lateral movement. The issue highlights a failure in secure API design, specifically the lack of consistent enforcement of authorization boundaries across administrative endpoints."
}