CVE-2026-3911: Keycloak: Information disclosure of disabled user attributes via administrative endpoint
(updated )
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
References
- access.redhat.com/errata/RHSA-2026:6477
- access.redhat.com/errata/RHSA-2026:6478
- access.redhat.com/security/cve/CVE-2026-3911
- bugzilla.redhat.com/show_bug.cgi?id=2446392
- github.com/advisories/GHSA-xh32-c9wx-phrp
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/commit/215bc1e27230f2a66670ed70262248b5f5254eb9
- github.com/keycloak/keycloak/issues/46922
- github.com/keycloak/keycloak/pull/46923
- nvd.nist.gov/vuln/detail/CVE-2026-3911
Code Behaviors & Features
Detect and mitigate CVE-2026-3911 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →