PT-2026-41869 · Red Hat · Keycloak

Osidb Bzimport · Published 2026-05-19 · Updated 2026-06-03 · CVE-2026-37978

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the Admin API allows a low-privilege administrator with the 'view-clients' role to cause cross-role personally identifiable information (PII) leakage. By invoking the 'evaluate-scopes' endpoint with an arbitrary userId parameter, an attacker can gain unauthorized visibility into user identities and authorizations across the realm. This issue is exploitable remotely via network access to the Admin API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-37978

GHSA-RRV7-3MQF-HXFR

Affected Products

Keycloak

References · 11

• https://access.redhat.com/errata/RHSA-2026:19597 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2455327 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:19596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-37978 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-37978 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rrv7-3mqf-hxfr · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/492d1f04cdad425dadb9d5e1faa94dd17a875573 · Note
• https://github.com/keycloak/keycloak/commit/ba9a18744dcec2ef46f284d25c1c0aa1c962a500 · Note
• https://t.me/cveNotify/165855 · Telegram Post
• https://twitter.com/dailycve/status/2062317662424752341 · Twitter Post