CVE-2026-3911: 
Java vulnerability analysis and mitigation

CVE-2026-3911 is an information disclosure vulnerability in Keycloak's UserResource component, specifically affecting the org.keycloak.services.resources.admin.UserResource class. An authenticated user holding the view-users role can access the administrative endpoint GET /admin/realms/{realm}/users/{UUID}/unmanagedAttributes to retrieve user attributes that have been configured with visibility set to "Disabled" — meaning they should not be accessible from any context. The flaw was disclosed on March 11, 2026, and affects Red Hat build of Keycloak versions 26.4 and 26.4.11 (text-only advisories also affected). It carries a CVSS v3.1 base score of 2.7 (Low), assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The GET /admin/realms/{realm}/users/{UUID}/unmanagedAttributes endpoint in Keycloak's admin REST API fails to enforce the configured visibility restrictions on unmanaged user attributes. Specifically, attributes set to "Disabled" visibility — which Keycloak's documentation states are "not available from any context" — are nonetheless returned in the API response to any authenticated caller with the view-users role. Exploitation requires network access to the Keycloak admin API and a valid account with the view-users role, but no further privileges or user interaction are needed (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in unauthorized disclosure of sensitive user attributes that administrators intentionally configured to be hidden from all contexts. This could expose personally identifiable information (PII) or other sensitive data stored as user attributes in Keycloak, violating user privacy and potentially regulatory compliance requirements (e.g., GDPR). The impact is limited to confidentiality — there is no integrity or availability impact — and the scope is confined to the affected Keycloak realm (Red Hat CVE, Red Hat Bugzilla).

1. Obtain credentials: Acquire valid Keycloak credentials for an account that has been granted the view-users role within the target realm.
2. Authenticate: Obtain a valid access token by authenticating against the Keycloak token endpoint (e.g., POST /realms/{realm}/protocol/openid-connect/token).
3. Enumerate users: Use the admin API to list users in the realm: GET /admin/realms/{realm}/users with the Bearer token to obtain user UUIDs.
4. Access hidden attributes: For each target user UUID, send a request to the vulnerable endpoint: GET /admin/realms/{realm}/users/{UUID}/unmanagedAttributes with the Bearer token. The response will include user attributes configured with "Disabled" visibility that should not be accessible.
5. Exfiltrate data: Collect and record the returned hidden attribute values, which may contain sensitive PII or security-relevant data (Red Hat Bugzilla).

• Network: Unusual or repeated HTTP GET requests to /admin/realms/{realm}/users/{UUID}/unmanagedAttributes from accounts that do not normally access this endpoint; access originating from unexpected IP addresses or outside normal business hours.
• Logs: Keycloak access logs showing requests to the unmanagedAttributes endpoint by accounts holding only the view-users role; bulk enumeration patterns where multiple user UUIDs are queried in rapid succession.
• Authentication: Successful logins followed immediately by admin API calls to the unmanagedAttributes endpoint, particularly from service accounts or non-administrative users.

Red Hat has released a patch in Red Hat build of Keycloak 26.4.11, addressed via security advisories RHSA-2026:6477 (packages) and RHSA-2026:6478 (container images for OpenShift), both issued on April 2, 2026. The upstream Keycloak project also released version 26.5.6 which includes the fix. As an interim workaround, administrators should restrict the view-users role assignment to only users who absolutely require it, implement network-level access controls to limit exposure of the Keycloak admin API, and audit user attribute configurations to minimize sensitive data stored as unmanaged attributes (RHSA-2026:6477, RHSA-2026:6478).