A flaw in the group search routine of the Keycloak administrative API allows a delegated administrator to gain visibility into parent groups that they normally cannot access when Fine‑Grained Admin Permissions (FGAP) v2 is enabled. By requesting information for a child group that the user is permitted to view, the API returns the full parent group details in the response. This results in an information disclosure of protected group attributes and configuration settings, potentially revealing organizational structure and sensitive permissions. The weakness is captured by CWE‑639, an authorization bypass through user‑controlled input.

Affected vendors include Red Hat for its Build of Keycloak, Red Hat Data Grid 8, JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. The impacted components are those utilizing the Keycloak services API; specific version numbers are not listed in the advisory, implying that the vulnerability spans affected builds referenced by the advisory.

The CVSS score of 4.3 indicates a low‑severity vulnerability. The EPSS score is reported as less than 1 %, suggesting a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been reported. The attack vector is inferred to be an administrative API call from a delegated administrator who has legitimate permission to view a child group; consequently, the flaw requires the FGAP v2 configuration to be enabled and the attacker to have some level of delegated administrative authority. Once those conditions are met, the attacker can retrieve disallowed parent group information and potentially other sensitive attributes embedded in the parent group data.