Bug 2455327 (CVE-2026-37978)

Summary: CVE-2026-37978 keycloak: org.keycloak.services: Keycloak: Information Disclosure via evaluate-scopes Admin API
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-06 07:56:56 UTC 
Cross-role information disclosure vulnerability in Keycloak’s evaluate-scopes Admin API endpoints. The flaw is caused by accepting an arbitrary userId parameter and validating only client permissions, without calling auth.users().requireView() or equivalent user-view checks. When a low-privilege admin with only the view-clients role invokes the evaluate-scopes endpoints, Keycloak generates example tokens that contain full profile and role data for any targeted user. This can be exploited remotely by such admins using only network access to the Admin API. The result is cross-role PII leakage, allowing unauthorized visibility into user identities and authorizations across the realm.