The vulnerability in Red Hat Build of Keycloak involves an authorization bypass through a user-controlled key parameter in the 'evaluate-scopes' Admin API endpoint. A low-privilege administrator possessing the 'view-clients' role can supply arbitrary user IDs to this endpoint, resulting in cross-role leakage of personally identifiable information. This enables unauthorized visibility into user identities and authorizations across the realm. The vulnerability is remotely exploitable via network access to the Admin API. The CVSS 3.1 base score is 4.9, reflecting medium severity with high confidentiality impact but no integrity or availability impact.

The impact of this vulnerability is unauthorized disclosure of personally identifiable information (PII) across user roles within the Keycloak realm. Confidentiality is compromised as a low-privilege administrator can view user identities and authorizations beyond their intended scope. There is no impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-37978 for current remediation guidance. Until an official fix is available, restrict network access to the Admin API to trusted administrators only and review role assignments to minimize exposure. Monitor Red Hat communications for updates on patches or mitigations.