This vulnerability in Red Hat build of Keycloak 26.4 arises from insufficient authorization checks in the Admin REST API endpoint /admin/realms/{realm}/roles. It allows an attacker with high privileges to access sensitive role metadata information that should otherwise be protected. The CVSS 3.1 base score is 2.7, reflecting a low severity impact limited to confidentiality with no impact on integrity or availability. Red Hat has released Keycloak 26.4.11 packages and updated container images that include fixes for this issue among others. The vendor advisory recommends applying these updates after backing up existing installations.

The vulnerability allows information disclosure of sensitive role metadata via improper access control in the Admin REST API. Exploitation requires high privileges, limiting the scope of impact. There is no impact on data integrity or service availability. No known exploits are reported in the wild. The overall severity is low.

Red Hat has released fixed packages and updated container images for Red Hat build of Keycloak 26.4.11 that address CVE-2025-14082. Users should back up their existing installations, including configurations and databases, before applying the update. Applying the official update from Red Hat Customer Portal is the recommended remediation. There is no indication that this vulnerability is mitigated by default or requires no action.