4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-37978

CVE-2026-37978: Keycloak: Information Disclosure via evaluate-scopes Admin API

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-37978

CVE-2026-37978:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.6.2	26.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the org.keycloak.services.resources.admin.ClientScopeEvaluateResource.getUserModel method, which failed to authorize if an administrator had the rights to view a user before returning the user's data. The patch 492d1f04cdad425dadb9d5e1faa94dd17a875573 directly addresses this by adding a try-catch block to call auth.users().requireView(user), which throws a ForbiddenException if the administrator lacks the appropriate permissions. This getUserModel method is called by several public-facing endpoints within the ClientScopeEvaluateResource class, such as generateAccessToken, generateIDToken, and getGranted, which serve as the entry points for exploiting this vulnerability. An attacker with limited administrative privileges (like 'view-clients') could have used any of these endpoints with an arbitrary userId to leak Personally Identifiable Information (PII) of any user in the realm. The runtime stack trace during exploitation would show one of the public methods calling the vulnerable getUserModel method.

Vulnerable functions

org.keycloak.services.resources.admin.ClientScopeEvaluateResource.getUserModel

services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateResource.java

This private method is responsible for fetching a user model based on a provided user ID. Prior to the patch, it did not perform any authorization checks to ensure the administrator invoking the API had permissions to view the requested user. This allowed any administrator with access to the 'evaluate-scopes' API (e.g., one with only 'view-clients' role) to retrieve information about any user in the realm by passing their ID, leading to information disclosure. The fix introduces a call to `auth.users().requireView(user)` to enforce this necessary authorization check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.