Keycloak Account Resources user lookup contains broken access control

TRUNG BÌNH 4.3CVE-2026-37981 · BIT-keycloak-2026-37981 · GHSA-933f-rg6j-f46p · Công bố 19/05/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-37981 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng org.keycloak:keycloak-services, build of keycloak (redhat).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.37%, cao hơn 31.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 26.6.2, 26.4.12 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.keycloak:keycloak-services Maven	`≥ 26.5.0, < 26.6.2< 26.4.12`	`26.6.226.4.12`
build of keycloak redhat	`≥ 26.4, < 26.4.12`	`26.4.12`

Mô tả

Keycloak's Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.

Mô tả của NVD

A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.