Cross-role Information Exposure in Keycloak by Red Hat

CVE-2026-37978

What is CVE-2026-37978?

A security flaw exists in Keycloak that allows low-privilege administrators holding the 'view-clients' role to exploit the Admin API. By invoking the 'evaluate-scopes' endpoint with arbitrary user ID parameters, such administrators can inadvertently leak personally identifiable information (PII) across roles. This unintended information exposure permits unauthorized visibility into user identities and their associated permissions, posing a significant risk to user privacy. The flaw can be remotely exploited with network access to the Admin API, making it essential for organizations to address this vulnerability urgently.

References