Bug 2537310 (CVE-2026-94213)

Summary: CVE-2026-94213 keycloak-services: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-21 05:51:26 UTC 
An information disclosure vulnerability was discovered in Keycloak within the Authorization Services policy evaluation endpoint. The flaw exists in the org.keycloak.services.resources.admin.fgap package, specifically where the endpoint processes policy evaluation requests.
The root cause is a failure to verify the callers permissions before resolving a user identity. When a delegated administrator with authorization viewing privileges (such as the view-authorization role) sends a request to the policy evaluation endpoint with a specific userId, the system constructs an identity token (RPT) for that user. This token, which includes the users email, full name, and effective role mappings, is returned in the response field.
Exploitation requires the attacker to have administrative access to a resource server but lacks the view-users permission. A successful attack allows the administrator to bypass intended access controls to read sensitive profile data and role assignments for any user within the target realm.