BIT-keycloak-2026-37978
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-37978.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-keycloak-2026-37978
- Aliases
-
- CVE-2026-37978
- GHSA-rrv7-3mqf-hxfr
- Published
- 2026-08-25T11:42:18Z
- Modified
- 2026-09-08T08:48:06Z
- Summary
- Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api
- Details
-
A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.
- Database specific
{ "cpes": [ "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*", "cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*" ], "severity": "Medium" }- References
Affected packages
Bitnami / keycloak
Package
- Name
- keycloak
- Purl
- pkg:bitnami/keycloak
Severity
- 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator