Vulnerability in Red Hat Build Of Keycloak 26.4
CVE-2026-3911
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes…
EPSS: 0.000 (2.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Red Hat Build Of Keycloak 26.4 — versions 26.4.11-1, 26.4-14
- Red Hat Build Of Keycloak 26.4.11
- Redhat Build_of_keycloak — versions 26.4, 26.4.11
Weakness classification (CWE)
References
- RHSA-2026:6477 (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- RHSA-2026:6478 (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry, Vendor Advisory)
- RHBZ#2446392 (x_refsource_REDHAT, issue-tracking, Issue Tracking)
Frequently asked questions
- What is CVE-2026-3911?
- CVE-2026-3911 is a low-severity vulnerability in Red Hat Build Of Keycloak 26.4, classified under Exposure of Private Personal Information to an Unauthorized Actor. CVSS score: 2.7/10. Published 2026-03-11.
- How severe is CVE-2026-3911?
- Low severity. CVSS v3 base score is 2.7 out of 10.