CVE-2026-37981: Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.
Other sources
Broken Access Control vulnerability in Keycloak’s Account Resources user lookup endpoint. The flaw is caused by validating only that the UMA resource ID belongs to the caller, without enforcing any relationship between that resource and the user being queried. When a crafted request is sent with arbitrary usernames or email values, the endpoint returns full profile objects (ID, username, name, email, status) for unrelated users. This can be exploited remotely by any authenticated user who owns at least one UMA-managed resource. Attackers can systematically enumerate and harvest PII for all realm users, leading to broad profile-level information disclosure.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37981?
The severity of CVE-2026-37981 is medium, with a CVSS score of 4.3.
What is CVE-2026-37981?
CVE-2026-37981 refers to a broken access control vulnerability in the Keycloak user lookup endpoint that allows information disclosure.
How do I fix CVE-2026-37981?
To fix CVE-2026-37981, it is recommended to update to the latest version of Keycloak that addresses this vulnerability.
What kind of information is disclosed by CVE-2026-37981?
CVE-2026-37981 allows authenticated users to enumerate and harvest personally identifiable information (PII) for all realm users.
Who is affected by CVE-2026-37981?
CVE-2026-37981 affects users of Keycloak who have implemented User-Managed Access (UMA) resources.