CVE-2025-13881: Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
Other sources
The Keycloak Admin API (/unmanagedAttributes) endpoint fails to respect the visibility configuration defined in the User Profile settings. This allows an administrator with limited privileges (specifically the view-users role) to retrieve sensitive custom attributes—such as phone numbers or personal addresses—that are explicitly configured to be hidden from both users and administrators in the GUI.
Requirements to exploit
The attacker must have a valid account on the realm. The attacker must have the view-users role (considered an admin privilege). The target realm must use the User Profile feature with custom attributes set to restricted visibility. Component affected: org.keycloak.services.resources.admin
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13881?
CVE-2025-13881 is considered a moderate severity vulnerability because it allows a limited administrator to access sensitive user attributes.
How do I fix CVE-2025-13881?
To mitigate CVE-2025-13881, update the Keycloak Admin API to version 26.5.2 or later.
Who is affected by CVE-2025-13881?
CVE-2025-13881 affects users of the Keycloak Admin API who have limited administrative privileges.
What type of attributes can be retrieved in CVE-2025-13881?
CVE-2025-13881 allows access to sensitive custom attributes through the admin API endpoints.
What versions are vulnerable to CVE-2025-13881?
Versions of the Keycloak Admin API prior to 26.5.2 are vulnerable to CVE-2025-13881.