A flaw exists in Keycloak’s UserResource component. An attacker who is authenticated and holds the view‑users role can hit a specific administrative endpoint and improperly retrieve user attributes that were configured to be hidden. This results in the confidential disclosure of sensitive user data. The vulnerability is a classic example of information leakage (CWE‑359).

Affected product is Red Hat Build of Keycloak, identified by CPE cpe:/a:redhat:build_keycloak:. No specific affected versions are listed in the provided data, so the vulnerability may apply to all installations of the product as currently shipped.

The CVSS score is 2.7, indicating low severity, and the EPSS score is below 1%, suggesting a very low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to already be authenticated with a user that has the view‑users role, implying that the threat surface is limited to environments where this role is granted. The primary risk is that sensitive user attributes may be exposed to an unauthorized administrator.