CVE-2026-3911: Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint

Severity: low (CVSS 2.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-11 · updated 2026-06-17
Weakness: CWE-359

Description

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.

Affected products

Red Hat build of Keycloak 26.4: 26.4, 26.4.11

References

https://access.redhat.com/errata/RHSA-2026:6477
https://access.redhat.com/errata/RHSA-2026:6478
https://access.redhat.com/security/cve/CVE-2026-3911
https://bugzilla.redhat.com/show_bug.cgi?id=2446392

Get alerted when CVE-2026-3911 or the next vulnerability affects your stack