REDHAT-BUG-2537310: Medium severity Keycloak Authorization Services policy evaluation endpoint vulnerability
An information disclosure vulnerability was discovered in Keycloak within the Authorization Services policy evaluation endpoint. The flaw exists in the org.keycloak.services.resources.admin.fgap package, specifically where the endpoint processes policy evaluation requests. The root cause is a failure to verify the callers permissions before resolving a user identity. When a delegated administrator with authorization viewing privileges (such as the view-authorization role) sends a request to the policy evaluation endpoint with a specific userId, the system constructs an identity token (RPT) for that user. This token, which includes the users email, full name, and effective role mappings, is returned in the response field. Exploitation requires the attacker to have administrative access to a resource server but lacks the view-users permission. A successful attack allows the administrator to bypass intended access controls to read sensitive profile data and role assignments for any user within the target realm.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Keycloak Authorization Services policy evaluation endpoint so that only callers with the view-users permission can query policy evaluation for a userId (attackers may have administrative access to a resource server but lack view-users).
- Compensating control
Ensure delegated administrators cannot call the policy evaluation endpoint for arbitrary userIds unless they are also granted the view-users permission (e.g., verify caller permissions before allowing user identity resolution).
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Keycloak realms where delegated administrators can administer a resource server and have authorization viewing privileges, such as the view-authorization role, are exposed. The issue affects attempts to restrict those administrators from viewing user profiles through the absence of the view-users permission.
What access does an attacker need to exploit it?
An attacker needs administrative access to a resource server, authorization viewing privileges, and the ability to submit a policy evaluation request with a chosen userId. They do not need the view-users permission.
What information can be disclosed?
The policy evaluation response can return an identity token for the selected user. The token includes the user's email address, full name, and effective role mappings.
How can an organization tell whether it may be affected?
Review whether delegated administrators with authorization viewing privileges can access the Authorization Services policy evaluation endpoint while lacking view-users permission. If they can submit evaluations for arbitrary userId values and receive identity-token data in the response, sensitive user data may be exposed.