CVE-2026-37981
Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint
- State
- Published
- Severity
- 4.3 Medium
- Published
- May 19, 2026
- Updated
- May 20, 2026
- Reserved
- Apr 6, 2026
Description
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-1220 Insufficient Granularity of Access Control
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.12Red Hat |
References
- RHSA-2026:19596vendor-advisory
- RHSA-2026:19597vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-37981vdb-entry
- RHBZ#2455326issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.