A low‑privilege administrator possessing the view‑clients role can invoke Keycloak’s evaluate‑scopes Admin API with an arbitrary user ID. This flaw leaks personally identifiable information and authorization data from other realms or users, allowing an attacker to view identities beyond their own. The weakness is categorized as an authorization bypass (CWE‑639).

The vulnerability affects Red Hat Build of Keycloak. No specific version ranges are listed; the flaw applies to any installation that has the evaluate‑scopes endpoint exposed to administrators with view‑clients privileges.

The CVSS score of 4.9 indicates low severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The attack vector, as described, is remote: an attacker must be able to reach the Admin API over the network. No vendor patch or known workaround exists, so the risk remains contingent on how broadly the API is exposed and how many administrators possess the view‑clients role.