Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-37981: Keycloak allows unauthorized access to user profiles
CVE-2026-37981 · published 5 months ago
Summary
A Keycloak vulnerability lets an authenticated user see information about other users in the system, including their personal details. This could be a concern for businesses that handle sensitive user data. To stay safe, update your Keycloak software to the latest version.
What to do
- Update keycloak org.keycloak:keycloak-services to version 26.4.12.
- Update keycloak org.keycloak:keycloak-services to version 26.6.2.
- Update keycloak to version 26.4.12.
- Update redhat build_of_keycloak to version 26.4.12 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | keycloak | org.keycloak:keycloak-services |
< 26.4.12 >= 26.5.0, < 26.6.2 Fix: upgrade to 26.4.12
|
| Bitnami | – | keycloak |
>= 26.4.0, < 26.4.12 Fix: upgrade to 26.4.12
|
| – | redhat | build_of_keycloak |
>= 26.4, < 26.4.12 cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* |
Original advisory text
Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-37981
- https://github.com/keycloak/keycloak/issues/49116
- https://github.com/keycloak/keycloak/pull/49122
- https://github.com/keycloak/keycloak/commit/33f6f873fda2c9546e52d34b4f865eafc42d...
- https://github.com/keycloak/keycloak/commit/b68070bcf96a6fe7d0f01cee5d3cbde71f2a...
- https://github.com/advisories/GHSA-933f-rg6j-f46p
- https://access.redhat.com/errata/RHSA-2026:19596 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19597 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-37981 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2455326 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-1220Insufficient Granularity of Access Control
Timeline
Published19 May 2026
Updated4 Nov 2026
First seen19 May 2026
Track software like this
Free during beta