Medium severity4.3NVD Advisory· Published May 19, 2026· Updated Jun 17, 2026
CVE-2026-37981
CVE-2026-37981
Description
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | < 26.4.12 | 26.4.12 |
org.keycloak:keycloak-servicesMaven | >= 26.5.0, < 26.6.2 | 26.6.2 |
Affected products
2Patches
Vulnerability mechanics
References
10- access.redhat.com/errata/RHSA-2026:19596nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2026:19597nvdVendor AdvisoryWEB
- access.redhat.com/security/cve/CVE-2026-37981nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdVendor AdvisoryWEB
- github.com/advisories/GHSA-933f-rg6j-f46pghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-37981ghsaADVISORY
- github.com/keycloak/keycloak/commit/33f6f873fda2c9546e52d34b4f865eafc42df0c0ghsaWEB
- github.com/keycloak/keycloak/commit/b68070bcf96a6fe7d0f01cee5d3cbde71f2abbe7ghsaWEB
- github.com/keycloak/keycloak/issues/49116ghsaWEB
- github.com/keycloak/keycloak/pull/49122ghsaWEB
News mentions
0No linked articles in our index yet.