Home

Description

A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.

PUBLISHED Reserved 2026-04-06 | Published 2026-05-19 | Updated 2026-05-20 | Assigner redhat




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

Insufficient Granularity of Access Control

Product status

Default status
affected

26.4.12-1 (rpm) before *
unaffected

Default status
affected

26.4-17 (rpm) before *
unaffected

Default status
affected

26.4-17 (rpm) before *
unaffected

Default status
unaffected

Timeline

2026-04-06:Reported to Red Hat.
2026-05-19:Made public.

Credits

Red Hat would like to thank XavLimSG for reporting this issue.

References

access.redhat.com/errata/RHSA-2026:19596 (RHSA-2026:19596) vendor-advisory

access.redhat.com/errata/RHSA-2026:19597 (RHSA-2026:19597) vendor-advisory

access.redhat.com/security/cve/CVE-2026-37981 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2455326 (RHBZ#2455326) issue-tracking

cve.org (CVE-2026-37981)

nvd.nist.gov (CVE-2026-37981)

Download JSON