PT-2026-41871 · Red Hat · Keycloak

Xavlimsg · CVE-2026-37981 · Published 2026-05-19 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A broken access control issue exists in the Account Resources user lookup endpoint. A remote authenticated user who owns at least one User-Managed Access (UMA) resource can enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values to the endpoint, the system returns full profile objects for unrelated users, resulting in broad profile-level information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1220

Related Identifiers

CVE-2026-37981

GHSA-933F-RG6J-F46P

Affected Products

Keycloak

References · 13

• https://access.redhat.com/security/cve/CVE-2026-37981 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2455326 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:19596 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-933f-rg6j-f46p · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:19597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-37981 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/pull/49122 · Note
• https://github.com/keycloak/keycloak/commit/33f6f873fda2c9546e52d34b4f865eafc42df0c0 · Note
• https://github.com/keycloak/keycloak/issues/49116 · Note
• https://github.com/keycloak/keycloak/commit/b68070bcf96a6fe7d0f01cee5d3cbde71f2abbe7 · Note
• https://t.me/cveNotify/165857 · Telegram Post
• https://twitter.com/dailycve/status/2062321459045814656 · Twitter Post