A vulnerability in the Authorization Services component of Keycloak allows delegated administrators with limited viewing privileges to access full profile and role information of any user in the realm. This occurs due to missing authorization checks in the policy evaluation endpoint used for testing access policies. Sensitive information such as email addresses and assigned security roles could be exposed. The issue has a medium severity with a CVSS score of 4.9. A security update is available from Red Hat in Keycloak version 26.6.8 addressing multiple vulnerabilities, though this specific CVE is not explicitly listed in the advisory excerpt provided.