The vulnerability exists in the policy evaluation endpoint of Keycloak's Authorization Services, where missing authorization checks permit delegated administrators with limited viewing rights to access complete user profile and role information beyond their permissions. This flaw could lead to unauthorized disclosure of sensitive user data. Red Hat has assessed the severity as moderate with a CVSS 3.1 base score of 4.9, noting that exploitation requires high privileges. No patch or effective mitigation is currently available according to Red Hat's advisory.

An attacker with high-level administrative privileges within a client or resource server can exploit this vulnerability to view sensitive user profile information and role mappings that should be restricted. This could lead to exposure of confidential data such as email addresses and security roles. There is no impact on integrity or availability reported. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality of user data.

Red Hat currently does not provide a patch or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires already having high administrative privileges, limiting delegated administrator roles and privileges may reduce risk. Customers with a Technical Account Manager (TAM) can consult directly for guidance. No official fix is available at this time.