A flaw in Keycloak allows an administrator who possesses manage‑users permission to bypass the "Only administrators can view" restriction on unmanaged attributes, enabling them to modify these attributes. This improper access control results in a direct integrity compromise of user profiles, potentially corrupting data that should be protected and enabling further misconfiguration or malicious activity. The weakness aligns with CWE‑266 (Missing Authorization for Modification).

Affected by Red Hat JBoss Enterprise Application Platform 8 and its Expansion Pack, Red Hat Single Sign‑On 7, and Red Hat builds of Keycloak 26.4including 26.4.9). The vulnerability is active in the Red Hat build of Keycloak 26.4 and newer versions associated with these products.

The CVSS score of 4.9 indicates a medium severity, while the EPSS score of less than 1% suggests exploitation is not common. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local or remote access to the administrator interface with manage‑users permission, making it an insider or compromised‑admin threat. Because only privileged users can trigger it, the risk is moderate, but the impact on integrity warrants timely attention.