CVE-2026-3911: Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
Other sources
The GET endpoint /admin/realms/{realm}/users/{UUID}/unmanagedAttributes returns user attributes configured with visibility set to "Disabled" (neither User nor Admin can view) to any authenticated user holding the view-users role. This violates the documented behavior stating disabled unmanaged attributes are "not available from any context."
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3911?
CVE-2026-3911 has a medium severity rating due to the potential for information disclosure of disabled user attributes.
How do I fix CVE-2026-3911?
To mitigate CVE-2026-3911, ensure that only authorized users with the appropriate roles have access to the UserResource component.
Who is affected by CVE-2026-3911?
CVE-2026-3911 affects Keycloak installations where authenticated users have the view-users role, allowing exploitation of the vulnerability.
What type of vulnerability is CVE-2026-3911?
CVE-2026-3911 is classified as an information disclosure vulnerability.
Can CVE-2026-3911 be exploited remotely?
CVE-2026-3911 requires authenticated access, meaning a user must already have specific permissions to exploit it.