The vulnerability in Red Hat Build of Keycloak involves the default-groups REST endpoint and realm representation component, which manages groups automatically assigned to new users within a realm. Due to improper access control, a delegated administrator with realm-viewing permissions can access the names and identifiers of hidden default groups without having the necessary permissions to view them. This leads to unauthorized information disclosure of internal group details. The CVSS 3.1 base score is 4.3, reflecting a low complexity attack vector with limited impact confined to confidentiality. There is no indication of integrity or availability impact. No known exploits are reported in the wild. The vendor advisory does not specify any patch or remediation status at this time.

The vulnerability allows unauthorized disclosure of sensitive information related to hidden default groups within a Keycloak realm. This could expose internal organizational structures or group names to delegated administrators who should not have access to this information. There is no impact on data integrity or system availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16108 for current remediation guidance. Until an official fix is available, review and restrict delegated administrator permissions to minimize exposure. No vendor advisory states that no action is required or that the issue is already mitigated.