CVE-2026-37981
MEDIUM
4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0003
Percentile
0,1th
Updated
EPSS Score Trend (Last 2 Days)
1220
Insufficient Granularity of Access Control
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Access Control
Potential Impacts:
Modify Memory
Read Memory
Execute Unauthorized Code Or Commands
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Other
Applicable Platforms
All platforms may be affected
https://access.redhat.com/errata/RHSA-2026:19596
https://access.redhat.com/errata/RHSA-2026:19597
https://access.redhat.com/security/cve/CVE-2026-37981
https://bugzilla.redhat.com/show_bug.cgi?id=2455326