2.7
Faible
CVE-2026-3911 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-14 | 26.4-14 |
| Red Hat build of Keycloak 26.4.11 | Versions non publiées |
Références
- RHSA-2026:6477 access.redhat.com
- RHSA-2026:6478 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2446392 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat build of Keycloak 26.4
Les 87 CVE de Red Hat build of Keycloak 26.4 →
CVE-2026-19607
A flaw was found in the first-broker-login flow of the keycloak-services component
5.3
Moyenne
CVE-2026-17526
Keycloak is an open-source identity and access management solution
7.2
Élevée
CVE-2026-79651
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service…
7.5
Élevée
CVE-2026-74909
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security…
8.1
Élevée