CVE-2026-3911: Red Hat Build Of Keycloak

Low severity, CVSS 2.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.

Affected products

• Red Hat Build Of Keycloak: affected versions not specified; version 26.4 only; version 26.4.11 only

Published 2026-03-11. Last modified 2026-06-17.