Description
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
Problem types
Exposure of Private Personal Information to an Unauthorized Actor
Product status
Timeline
| 2026-03-11: | Reported to Red Hat. |
| 2026-03-11: | Made public. |
Credits
Red Hat would like to thank drak3hft7 for reporting this issue.
References
access.redhat.com/security/cve/CVE-2026-3911
bugzilla.redhat.com/show_bug.cgi?id=2446392 (RHBZ#2446392)