CVE-2026-37981 affects Red Hat build of Keycloak 26.4 and is caused by insufficient granularity of access control in the Account Resources user lookup endpoint. This flaw permits a remote authenticated user with at least one UMA resource to enumerate and harvest PII of all users within the realm by crafting requests with arbitrary usernames or email values, leading to broad profile-level information disclosure. Red Hat has released Keycloak version 26.4.12 to fix this and other vulnerabilities. The vulnerability has a CVSS v3.1 score of 4.3 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, requires privileges, no user interaction, unchanged scope, and limited confidentiality impact. No known active exploitation has been reported. The vendor advisory recommends backing up existing installations before applying the update.

The vulnerability allows an authenticated user who owns at least one UMA resource to enumerate and harvest personally identifiable information of all users in the Keycloak realm. This results in broad profile-level information disclosure, potentially exposing sensitive user data. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Red Hat has released an updated package, Keycloak 26.4.12, which addresses this vulnerability along with several others. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official update fully mitigates this vulnerability. No additional mitigations are specified or required beyond applying the update.