A broken access‑control flaw in the Keycloak Account Resources user‑lookup endpoint allows a remote authenticated user who possesses at least one UMA resource to enumerate and acquire personally identifiable information for every user in the realm. By sending crafted requests that include arbitrary usernames or e‑mail addresses, the endpoint returns full profile objects for users that the attacker does not own, leading to the disclosure of broad profile‑level information.

The vulnerability affects Red Hat Build of Keycloak; specific version information is not supplied in the advisory, so any deployment of this build that has not yet been patched may be vulnerable.

The CVSS score of 4.3 indicates medium impact, but the lack of an EPSS score and absence from the KEV catalog suggest low exploitation probability at present. The attack requires remote authenticated access plus the creation of at least one UMA resource, so an attacker must first be authenticated and have associated resources before the flaw can be exploitably used.