CVE-2026-17059: Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A missing authorization filter flaw was found in Keycloaks role-users REST API endpoint. When an authenticated user with restricted administrative privileges such as query-users and view-realm requests the list of users assigned to a specific role via GET /admin/realms/{realm}/roles/{role-name}/users, the system returns the full representation of all member users. The root cause is that the RoleResource.getRoleUserMembers method verifies the callers permission to view the role but fails to apply the per-user view filter to the resulting list. This allows a delegated administrator to bypass intended access restrictions and perform unauthorized enumeration of user PII, including usernames, email addresses, and full names, for any user assigned to a role the administrator can view.

— Red Hat