The vulnerability in Red Hat Build of Keycloak (CVE-2026-9088) arises from insufficient granularity in access control. Specifically, an administrator granted delegated read access to group memberships and users can circumvent user profile permission restrictions by querying the group members endpoint. This bypass enables the administrator to view user attributes explicitly configured to be denied, causing unauthorized information disclosure. The CVSS score is 2.7 (low severity), reflecting limited impact confined to confidentiality. No patch or remediation level has been officially provided by Red Hat at this time.

The impact is limited to information disclosure of user attributes that should be restricted. There is no impact on integrity or availability. The vulnerability requires an administrator-level user with delegated read access, reducing the likelihood of exploitation by lower-privileged actors. No known exploits exist in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9088 for current remediation guidance. Until an official fix is available, organizations should review and potentially restrict delegated administrator permissions to minimize exposure. No vendor advisory indicates that no action is required or that the issue is already mitigated.