CVE-2026-94213: Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity
A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.
Other sources
An information disclosure vulnerability was discovered in Keycloak within the Authorization Services policy evaluation endpoint. The flaw exists in the org.keycloak.services.resources.admin.fgap package, specifically where the endpoint processes policy evaluation requests. The root cause is a failure to verify the callers permissions before resolving a user identity. When a delegated administrator with authorization viewing privileges (such as the view-authorization role) sends a request to the policy evaluation endpoint with a specific userId, the system constructs an identity token (RPT) for that user. This token, which includes the users email, full name, and effective role mappings, is returned in the response field. Exploitation requires the attacker to have administrative access to a resource server but lacks the view-users permission. A successful attack allows the administrator to bypass intended access controls to read sensitive profile data and role assignments for any user within the target realm.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to Keycloak Authorization Services policy evaluation endpoint so only callers with both (a) administrative access to the resource server and (b) the explicit user viewing privilege are allowed; block delegated administrators that lack the view-users permission from calling the policy evaluation endpoint with arbitrary userId values.
Event History
Frequently Asked Questions
Who can exploit this issue?
A delegated administrator with limited viewing privileges, including authorization viewing access such as the view-authorization role, can exploit it. The attacker must be able to send policy evaluation requests to the Authorization Services endpoint.
What information can be exposed?
The affected endpoint can return the full profile and role information for any user in the same realm. Exposed data may include email addresses and assigned security roles.
Does exploitation require targeting a specific user?
Yes. The policy evaluation request includes a specific userId, and the vulnerable processing resolves that user's identity without verifying that the caller is allowed to view the user's details.
Are ordinary unauthenticated users affected?
The provided information describes exploitation by an authenticated delegated administrator with authorization viewing privileges. It does not indicate that unauthenticated access can exploit the issue.