CVE-2026-3911

Katalog CVE

CVSS 2.7 · Low EPSS 0,41%

Kerentanan Exposure of Private Personal Information to an Unauthorized Actor pada redhat build of keycloak. Skor CVSS 3.1 2.7 (Low) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.7 (Low), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:6477 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:6478 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-3911 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2446392 issue tracking