The vulnerability resides in the UMA 2.0 Protection API endpoint for permission tickets, which fails to verify that a requesting user has the required "uma_protection" role. As a result, any authenticated user who possesses a token issued for a resource server client—regardless of whether they hold the role—can query and enumerate all permission tickets in the system. The attack does not grant code execution or elevated privileges, but it does expose potentially sensitive authorization data, leading to a partial information disclosure. The weakness is a failure in authenticating permitted actions, reflected by CWE‑280.

This flaw affects Red Hat Build of Keycloak version 26.4 and sub‑release 26.4.11 running on Red Hat Enterprise Linux 9. No other Keycloak releases or vendors are listed as impacted in the CNA data.

The CVSS score is 4.3, indicating a medium severity and competitive impact. The EPSS value is below 1%, denoting a very low likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. Attackers would need to authenticate with a valid token issued for a resource server client; no additional privileges or pre‑conditions are required beyond standard authentication. Because the exploit only reveals data, the risk to confidentiality is moderate but the overall impact is reduced by the low exploitation probability.