A vulnerability in the Admin REST API of Keycloak allows delegated administrators with basic search privileges to bypass group visibility restrictions. Specifically, the API endpoints that retrieve groups associated with a role do not properly enforce individual group visibility permissions, enabling unauthorized access to detailed information about all groups assigned to that role.