Executive Summary

This vulnerability exists in Keycloak where an administrator who has delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint.

As a result, the administrator can view user attributes that are explicitly configured to be denied, leading to unauthorized information disclosure.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to information disclosure by allowing an administrator with certain delegated permissions to access user attributes that should be restricted.

This means sensitive user data that was intended to be hidden can be viewed, potentially compromising user privacy and security.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an administrator with delegated access to bypass user profile permissions and view user attributes that are explicitly configured to be denied. Such unauthorized disclosure of user information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

By exposing restricted user attributes, the flaw increases the risk of information disclosure, potentially violating privacy and security requirements mandated by these standards.

Useful 0 Not Useful 0