CVE-2026-37978

Published: May 19, 2026Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.

Affected (1)

Products: Redhat: Build Of Keycloak

1 product

Build Of Keycloak

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Keycloak	Before 26.4.12

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://access.redhat.com/errata/RHSA-2026:19596

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:19597

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-37978

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2455327

Source: secalert@redhat.com

Vendor Advisory

Timeline

No history available yet.