Search: CVE-2026-37978

CVE-2026-37978 is a medium severity vulnerability in Red Hat build of Keycloak 26.4 where a low-privilege administrator with the 'view-clients' role can exploit the 'evaluate-scopes' Admin API endpoint by supplying an arbitrary user ID. This flaw allows unauthorized disclosure of personally identifiable information (PII) across user roles within the realm. The vulnerability can be exploited remotely via network access to the Admin API. Red Hat has released security updates in version 26.4.12 addressing this and other vulnerabilities. Users are advised to apply the update after backing up their installations.