Bug 2560583 (CVE-2026-116470)
| Summary: | CVE-2026-116470 keycloak-services: keycloak-services: SCIM user listing endpoint returns full PII without per-user VIEW authorization check | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the SCIM user listing endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the endpoint fails to perform per-user VIEW authorization checks when returning user lists. This allows a service account or user with limited query permissions to retrieve full personally identifiable information (PII), such as names and email addresses, for all non-admin users in a realm. This could lead to unauthorized data exposure in environments where the SCIM API is enabled.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
A Missing Authorization flaw was found in the SCIM user listing endpoint (GET /realms/{realm}/scim/v2/Users) of Keycloak. The endpoint only verifies if the calling principal holds the query-users role but fails to enforce per-user VIEW authorization checks, which are correctly enforced by other SCIM and Admin REST endpoints. This is a regression caused by the removal of a protection layer during a previous fix for Fine-Grained Admin Permissions (FGAP) v2. Exploitation requires the SCIM API to be enabled, the realm attribute scimApiEnabled to be set to true, and the realm to be using the default role-based permission model. An attacker must also possess a valid bearer token with the query-users role and a specific audience claim. Successful exploitation allows an attacker to retrieve full PII (including email, name, and custom attributes) for every non-admin local user in the realm.