CVE-2026-3911

published 2026-03-11

CVE-2026-3911: A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a…

low 2.7 CVSS 3.1

AV N AC L PR H UI N S U C L I N A N

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
redhat	build_of_keycloak	—	—
redhat	build_of_keycloak	—	—

CWE-359