A flaw in Keycloak allows an authenticated user who is a member of an organization to retrieve organization metadata through user-facing APIs such as the account API or by requesting an OIDC token with the 'organization' scope. This disclosure persists even after an administrator has disabled the Organizations feature, allowing organization data to appear in tokens and possibly causing resource servers to make incorrect authorization decisions. The weakness is a flaw in authorization enforcement (CWE-863).

The vulnerability affects Red Hat Build of Keycloak. No specific product versions are identified in the advisory; administrators should verify whether their deployed instances fall under the affected build.

The CVSS score of 4.3 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be an authenticated user who already has organization membership; no remote code execution or privilege escalation is involved. The exploitation pathway involves normal API interactions or OIDC token requests, making the flaw relatively low in operational difficulty but potentially significant if organization data is sensitive. Administrators should assess the likelihood of such an authenticated user and the impact of leaked metadata on their environment.