CVE-2026-37981

Katalog CVE

CVSS 4.3 · Medium EPSS 0,42%

Kerentanan Insufficient Granularity of Access Control pada redhat build of keycloak. Skor CVSS 3.1 4.3 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.

Rincian

Terbit di NVD

19 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1220: Insufficient Granularity of Access Control

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:19596 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:19597 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-37981 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2455326 advisory vendor