A flaw in the Admin REST API of Keycloak allows a delegated administrator with basic search privileges to see detailed information about all groups assigned to a role, because the endpoint that retrieves those groups does not enforce group‑visibility permissions. This bypasses the intended restriction that only certain groups should be viewable by a given administrator. The impact is the exposure of potentially sensitive group data, which could enable an attacker to map the organization’s group structure and privilege model. The flaw is a classic authorization bypass reflected in CWE‑862.

The affected products are Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. No specific version numbers are provided, so any deployment of these products that contains the vulnerable Admin REST API is at risk.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is not available, so a quantitative estimate of exploitation likelihood is not provided. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented large‑scale exploits. The likely attack vector is via the exposed Admin REST API, inferred because the description talks about role‑group retrieval through API calls. An attacker would need to be a delegated administrator with search privileges, a role that is reasonably common in administrative delegations, which makes the condition of exploitation feasible in many installations.