A flaw in Keycloak's Admin UI extension allows certain administrators to bypass Fine‑Grained Admin Permissions (FGAPv2) when searching for users. The specific "brute‑force‑user" endpoint does not verify whether the caller holds the required "view" permission on individual users, enabling a user with only search privileges to retrieve a full profile of any user, including sensitive data. This privilege or permission bypass (CWE‑639) may lead to unintended disclosure of user information and security metadata.

Affected systems are Red Hat Build of Keycloak and the Red Hat JBoss Enterprise Application Platform Expansion Pack. No specific affected versions are referenced in the advisory.

The CVSS base score is 4.3, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is an authenticated administrator possessing search rights; exploitation requires access to the internal brute‑force‑user API endpoint. Once triggered, such an attacker can view full profiles of all users, potentially exposing sensitive information and security metadata. The risk remains contingent on internal network exposure and role assignment. No effective workaround is currently offered by the vendor; until a patch is released, users should consider restricting API access or applying stricter role assignments.