A vulnerability exists in Red Hat build of Keycloak 26.4 where a low-privilege administrator possessing the 'view-clients' role can invoke the 'evaluate-scopes' Admin API endpoint with an arbitrary userId parameter. This results in authorization bypass leading to cross-role leakage of personally identifiable information (PII), exposing user identities and authorizations beyond intended access controls. The vulnerability is remotely exploitable via network access to the Admin API. Red Hat has issued security advisories and released version 26.4.12 containing fixes for this issue along with several others.

The vulnerability allows unauthorized users with limited administrative privileges to access sensitive personally identifiable information (PII) of users across the realm, violating confidentiality. There is no impact on integrity or availability reported. Exploitation requires network access to the Admin API and a low-privilege administrator role. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update in Red Hat build of Keycloak version 26.4.12 that addresses this vulnerability along with other security issues. Users should back up their existing installations, including configurations and databases, before applying the update. Applying this update is the recommended remediation. No alternative mitigations or temporary fixes are indicated in the vendor advisory.