The flaw exists in org.keycloak.services. An administrator that has been granted delegated access to read group memberships and users can override the user profile permissions by invoking the group members endpoint. This bypass allows the administrator to see user attributes that are explicitly configured to be denied, revealing confidential information. The weakness is classified as CWE-1220 and carries a modest CVSS score of 2.7.

The vulnerability applies to Red Hat Build of Keycloak. No specific version details are supplied, so any instance of this distribution may be affected, as indicated by the CPE string presented by the CNA.

The overall severity is low, reflected by the CVSS rating of 2.7 and the absence of an EPSS score or KEV listing. The attack requires an attacker to possess administrator credentials with delegated read group membership privileges; the likely attack vector is therefore an internal compromise or credential theft. Because no official patch or workaround is available at this time, the risk can be mitigated by restricting such delegated permissions and monitoring for anomalous access to the group members endpoint.