Skip to content

[GHSA-933f-rg6j-f46p] A flaw was found in Keycloak. A broken access control... #7765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
coffeemakr wants to merge 1 commit into
base: coffeemakr/advisory-improvement-7765
Choose a base branch
from
Open

[GHSA-933f-rg6j-f46p] A flaw was found in Keycloak. A broken access control... #7765

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion advisories/unreviewed/2026/05/GHSA-933f-rg6j-f46p/GHSA-933f-rg6j-f46p.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,35 @@
"aliases": [
"CVE-2026-37981"
],
"summary": "Broken Access Control in Account Resources User Lookup allows PII enumeration",
"details": "A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "26.6.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
Expand Down