A flaw in Keycloak’s UserResource component allows an authenticated user who holds the view-users role to access an administrative endpoint and retrieve user attributes that should be hidden, resulting in the unauthorized disclosure of sensitive data. The vulnerability stems from improper handling of hidden attributes and manifests as an information exposure flaw. It does not compromise system integrity or availability, but the breach can expose personally identifiable information or other confidential user data.

The issue affects Red Hat’s build of Keycloak 26.4 and the 26.4.11 sub‑release running on Enterprise Linux 9. Users of these versions who have been granted the view-users role are potentially exposed to the disclosure of hidden attributes.

The CVSS score of 2.7 indicates a low overall severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely in the wild. The flaw is not listed in the CISA KEV catalog, and because an attacker must be authenticated and possess the view-users role, the attack vector is internal credential‑based. While it does not lead to code execution or denial of service, the breached confidentiality could impact many users if the system stores sensitive attributes that are meant to remain hidden.