CVE-2026-37981

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A broken access control issue exists in the Account Resources user lookup endpoint. A remote authenticated user who owns at least one User-Managed Access (UMA) resource can enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values to the endpoint, the system returns full profile objects for unrelated users, resulting in broad profile-level information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.