CVE-2026-37978

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:19596	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19597	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-37978	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2455327	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en Keycloak. Un administrador de bajo privilegio con el rol ’view-clients’ puede explotar esto invocando los endpoints de la API de administración ’evaluate-scopes’ con un parámetro de ID de usuario (userId) arbitrario. Esta vulnerabilidad permite la fuga de información de identificación personal (PII) entre roles, lo que permite una visibilidad no autorizada de las identidades y autorizaciones de los usuarios en todo el realm. La explotación es posible remotamente mediante acceso a la red a la API de administración.

Information

Published : 2026-05-19 12:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-37978

Mitre link : CVE-2026-37978

CVE.ORG link : CVE-2026-37978

JSON object : View

Products Affected

redhat

build_of_keycloak

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-37978", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-37978", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T12:23:30.773288Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4.12-1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.12", "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T12:16:17.540", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:19597", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-37978", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455327", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Keycloak. Un administrador de bajo privilegio con el rol \u2019view-clients\u2019 puede explotar esto invocando los endpoints de la API de administraci\u00f3n \u2019evaluate-scopes\u2019 con un par\u00e1metro de ID de usuario (userId) arbitrario. Esta vulnerabilidad permite la fuga de informaci\u00f3n de identificaci\u00f3n personal (PII) entre roles, lo que permite una visibilidad no autorizada de las identidades y autorizaciones de los usuarios en todo el realm. La explotaci\u00f3n es posible remotamente mediante acceso a la red a la API de administraci\u00f3n."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F167CED9-6F3C-4C5F-BF3B-D8944F844345", "versionEndExcluding": "26.4.12"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}