Improper Access Control vulnerability in the Keycloak Admin REST API. A user possessing only the built-in role_query-groups permission can retrieve the complete list of realm roles, including sensitive administrator-created roles and internal metadata. Although the user cannot access full role details or modify configurations, this unintended exposure of role names, IDs, composite status, and container identifiers stems from insufficient authorization checks on the /admin/realms/{realm}/roles endpoint. A remote authenticated attacker with high-privileged (but restricted) access can leverage this information disclosure to map privilege structures and plan targeted privilege-escalation attempts, affecting the confidentiality of Keycloak deployments.