Red Hat Keycloak CVE-2026-37981

Exploitation requires two specific conditions: (1) the attacker must hold a valid authenticated session within the target Keycloak realm - confirmed by the CVSS vector PR:L (low privileges required); and (2) the attacker's account must own at least one User-Managed Access (UMA) resource within that realm, as this is what grants access to the Account Resources endpoint. UMA support must be enabled in the realm configuration, which is a non-default or explicitly provisioned state in many deployments. Exploitation is limited to confidentiality impact within the same realm scope (S:U - no scope change). Attackers cannot impact integrity or availability, and cannot cross realm boundaries. The primary limiting factors are the requirement for prior authentication and UMA resource ownership - unauthenticated external attackers cannot exploit this directly.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable, low-complexity vulnerability requiring only low-privilege authentication with no user interaction - but scoped only to confidentiality with no integrity or availability impact. In practice, the real-world risk exceeds what the base score suggests for multi-tenant or enterprise Keycloak deployments: a single compromised or malicious user account with any UMA resource can systematically enumerate every realm user's full profile, constituting a bulk PII exfiltration risk potentially triggering GDPR or similar regulatory obligations. No EPSS data was provided in the input, no POC is publicly confirmed, and this CVE is not in the CISA KEV catalog, so exploitation remains theoretical but the barrier to exploit is very low given the minimal privilege requirement. There is no CVSS/description conflict - both consistently indicate authenticated network access is sufficient.

An attacker who holds a regular Keycloak account and has created or been granted ownership of at least one UMA resource authenticates to the realm and sends a series of crafted HTTP requests to the Account Resources user lookup endpoint, cycling through known or guessed usernames and email addresses. Each request returns a full user profile object for the targeted realm member, enabling systematic harvesting of names, email addresses, and other PII stored in Keycloak profiles. No public POC code is confirmed, but the attack requires only standard HTTP tooling and knowledge of the API endpoint structure.