CVE-2026-37981
Redhat Build Of Keycloak 26.4 – 26.4.12
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-37981 is a medium-severity Insufficient Granularity of Access Control (CWE-1220) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30881
Vulnerability Data
A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII)…
more
for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Broken access control on user lookup enables authenticated account/email enumeration and PII harvesting.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access control policy on the Account Resources endpoint so that only authorized owners can retrieve their own UMA-related data, blocking enumeration of arbitrary user profiles.
Restricts the privileges granted to any authenticated user (even one owning a UMA resource) so the endpoint cannot be abused to read PII of unrelated realm users.
Enforces information-flow rules that prevent the lookup endpoint from returning full profile objects belonging to users outside the caller's authorized scope.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.IR-01's segmentation + zero-trust rules directly enforce minimum-necessary access at network boundaries, removing most instances of overly broad policy; CWE-1220 can still exist in application-layer or intra-segment controls that this single outcome does not address.
PR.PS-06's general SDLC practices can surface granularity issues during design/review (partial prevention) but do not specifically target access-control policy breadth, so they remove only part of CWE-1220's risk.
CWE-1220 permits unauthorized access to sensitive assets but neither prevents nor impairs the delivery of adverse-event information to authorized recipients.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.
Establishes the overarching access-control policy whose granularity directly determines whether the weakness exists.
Defines the assignment and review of access rights; insufficient granularity in those rights is the root of CWE-1220.
Specifies management of privileged access rights, where overly broad privileges are a common manifestation of the weakness.
Limits use of privileged utilities; overly coarse access rules can still allow unauthorized utility access.