CVE-2026-17059 is an authorization bypass vulnerability in the role-users endpoint of the keycloak-services library, a core component of the Keycloak identity and access management solution used by Red Hat. The vulnerability occurs because the system fails to check whether an administrator has permission to view individual users when listing members of a role. As a result, a restricted administrator can access private information, including names and email addresses, of users they are not authorized to see. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. There is no vendor advisory content indicating a patch or remediation level, and no affected versions are explicitly stated.

Restricted administrators can view private user information such as names and email addresses of users they should not have access to. This exposure of sensitive personal data can lead to privacy violations and potential misuse of user information. The vulnerability does not affect system integrity or availability according to the provided data.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17059 for current remediation guidance. No official fix or workaround is indicated in the provided data. Until a patch is available, consider restricting administrator privileges and monitoring access to sensitive user information as a precaution.