A flaw in Keycloak’s UserResource component allows an authenticated user who holds the view-users role to access an administrative endpoint and retrieve user attributes that should be hidden, resulting in the unauthorized disclosure of sensitive data. The vulnerability stems from improper handling of hidden attributes and aligns with CWE‑359, which focuses on unintended disclosure of protected data. This lack of confidentiality can expose personal or organizational information without affecting the system’s integrity or availability.

The issue affects Red Hat’s build of Keycloak 26.4 and its 26.4.11 sub‑release running on Enterprise Linux 9. Users of these versions that have been granted the view-users role are potentially exposed to the disclosure of hidden attributes.

The CVSS score of 2.7 indicates a low overall severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely in the wild. The flaw is not listed in the CISA KEV catalog, and because an attacker must be authenticated and possess the view-users role, the attack vector is internal credential‑based. Although it does not lead to code execution or denial of service, the breached confidentiality could affect many users if the system stores sensitive attributes that are meant to remain hidden.