Broken Access Control vulnerability in Keycloak’s Account Resources user lookup endpoint. The flaw is caused by validating only that the UMA resource ID belongs to the caller, without enforcing any relationship between that resource and the user being queried. When a crafted request is sent with arbitrary usernames or email values, the endpoint returns full profile objects (ID, username, name, email, status) for unrelated users. This can be exploited remotely by any authenticated user who owns at least one UMA-managed resource. Attackers can systematically enumerate and harvest PII for all realm users, leading to broad profile-level information disclosure.