The flaw lies in the policy evaluation endpoint of the Authorization Services component, where missing access control allows a delegated administrator with limited viewing privileges to retrieve complete user profiles and security role information. This can expose email addresses and role assignments, violating confidentiality. The weakness matches the lack of authorization checks described by CWE‑862.

Affected are Red Hat Build of Keycloak and Red Hat Single Sign‑On version 7. No specific version sub‑details are provided, but any installation using the policy evaluation endpoint in these products is vulnerable.

The CVSS score of 4.9 indicates a moderate risk; an exploit requires only a delegated administrator credential and does not need additional privilege escalation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely internal to an organization where a delegated admin credential can be obtained or misused. Because no workaround exists, administrators should limit access to the endpoint and monitor usage until an official patch is released.