2.7
Low
CVE-2026-3911 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-14 | 26.4-14 |
| Red Hat build of Keycloak 26.4.11 | Versions not published |
References
- RHSA-2026:6477 access.redhat.com
- RHSA-2026:6478 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2446392 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat build of Keycloak 26.4
The 87 CVEs of Red Hat build of Keycloak 26.4 →
CVE-2026-19607
A flaw was found in the first-broker-login flow of the keycloak-services component
5.3
Medium
CVE-2026-17526
Keycloak is an open-source identity and access management solution
7.2
High
CVE-2026-79651
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service…
7.5
High
CVE-2026-74909
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security…
8.1
High