~ / search / GHSA-rrv7-3mqf-hxfr

GHSA-rrv7-3mqf-hxfr

Keycloak: Information Disclosure via evaluate-scopes Admin API

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-37978

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.6.2 26.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.

References

External links from the advisory. They lead to third-party sites.