The vulnerability in Red Hat Build of Keycloak's keycloak-services library involves an authorization bypass in the role-users endpoint. Specifically, the system fails to check whether an administrator has the appropriate permissions to view individual users when listing members of a role. As a result, restricted administrators can access private user data, including names and email addresses, that should be protected. The CVSS 3.1 base score is 6.5, indicating a medium severity impact with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no vendor advisory content indicating a patch or remediation status at this time.

Restricted administrators can view private information such as names and email addresses of users they are not authorized to access. This leads to unauthorized disclosure of sensitive user data. The vulnerability does not impact integrity or availability but compromises confidentiality.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17059 for current remediation guidance. Until a fix is available, restrict administrator permissions carefully to minimize exposure. Monitor official Red Hat channels for updates.