A flaw allows the exposure of backend schema and rule information through the Keycloak Admin REST API. The improper access control can potentially enable an attacker to gather sensitive configuration details, which could be leveraged in targeted attacks or to elevate privileges within the environment. The weakness is identified as an authority and access control flaw.

Systems running Red Hat build of Keycloak version 26.4, including the 26.4.11 revision, are affected. The impacted product is identified as the Red Hat Keycloak build for Enterprise Linux 9, indicated by the corresponding CPE.

The CVSS score of 2.7 indicates a low severity. The EPSS score is reported as less than 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector involves unauthorized or unintended access to the Keycloak Admin REST API, which may be accessible to users who lack proper administrative permissions. An attacker who can issue API requests would be able to extract backend schema details, while exploitation would be limited to information disclosure unless additional privilege escalation mechanisms exist.