A missing authorization check in the Admin REST API of Red Hat Build of Keycloak allows delegated administrators with limited privileges to bypass fine-grained visibility controls. Specifically, the API endpoints that retrieve groups associated with a role do not properly enforce individual group visibility permissions, enabling unauthorized disclosure of group metadata and membership information. The vulnerability requires the attacker to already have delegated administrative privileges and does not impact integrity or availability. Red Hat has assessed the severity as moderate and currently has no mitigation or fix that meets their criteria for ease of deployment and applicability.

An attacker with delegated administrative privileges can bypass intended security restrictions to view detailed information about all groups assigned to a role, including group metadata and membership. This leads to unauthorized disclosure of sensitive group information. The vulnerability does not affect data integrity or availability. Exploitation requires existing delegated admin privileges, limiting the scope of impact.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, or applicability. Users should monitor the Red Hat advisory for updates. Since exploitation requires delegated administrative privileges, restricting and auditing such privileges may reduce risk. No official fix or patch is currently available.