This vulnerability in Red Hat Build of Keycloak arises from insufficient granularity in access control on the Account Resources user lookup endpoint. It allows a remote authenticated user with at least one UMA resource to query the endpoint with arbitrary usernames or email addresses and receive full profile objects of unrelated users. This leads to unauthorized disclosure of personally identifiable information across the realm. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality impact. No official fix or patch information is provided in the vendor advisory, and the product is not a cloud service.

The impact is limited to confidentiality, specifically unauthorized disclosure of personally identifiable information of all realm users. Integrity and availability are not affected. The vulnerability requires the attacker to be an authenticated user with at least one UMA resource, which limits the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-37981 for current remediation guidance. Until a fix is available, restrict UMA resource ownership to trusted users and monitor for unusual access patterns involving the Account Resources user lookup endpoint. No vendor advisory content indicates that the issue is already mitigated or that no action is required.