GHSA-XQR9-4WVV-GVCH OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

Summary A realm admin of tenant B can read the profile, client roles, and realm roles of any user in any other realm including the master realm by supplying the target user's UUID in the REST API path. Three read endpoints in UserResourceImpl check whether the caller holds the read:admin role but...

PT-2026-56060

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.24.2 Description An improper access control issue exists in the UserResourceImpl.java file. The get, getUserClientRoles, and getUserRealmRoles methods authorize callers with the read:admin role without verifying ...

CVE-2026-37978

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID userId parameter. This vulnerability allows for cross-role personally identifiable information PII leakage,...