This vulnerability in Keycloak's Admin UI extension occurs when Fine-Grained Admin Permissions (FGAPv2) are enabled. An administrator who should only be able to search for users but not view their full details can exploit a brute-force-user endpoint to access full user profiles, including sensitive information and security metadata. The root cause is a missing authorization check for the 'view' permission on the specific user when accessed via this endpoint. The vulnerability requires the attacker to have the 'query-users' administrative role and knowledge of the target user's ID. Red Hat has assessed this as a moderate severity issue with a CVSS 3.1 base score of 4.3. Currently, no remediation or patch meets Red Hat's criteria for deployment, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrative privileges limited to user search capabilities to bypass fine-grained authorization controls and view sensitive user data they are not authorized to see. This results in unauthorized disclosure of user profile information and security metadata. The vulnerability does not impact system integrity or availability. Exploitation requires prior administrative privileges and knowledge of the target user's identifier.

Red Hat currently does not provide an official patch or mitigation that meets their criteria for ease of use, applicability, and stability. Users should monitor Red Hat advisories for updates. Until a fix is available, restricting administrative privileges to trusted personnel and limiting knowledge of user IDs may reduce risk. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for guidance. Applying the upcoming Red Hat build of Keycloak 26.4.14 update, which includes this fix, is recommended once available.