Cross-role information disclosure vulnerability in Keycloak’s evaluate-scopes Admin API endpoints. The flaw is caused by accepting an arbitrary userId parameter and validating only client permissions, without calling auth.users().requireView() or equivalent user-view checks. When a low-privilege admin with only the view-clients role invokes the evaluate-scopes endpoints, Keycloak generates example tokens that contain full profile and role data for any targeted user. This can be exploited remotely by such admins using only network access to the Admin API. The result is cross-role PII leakage, allowing unauthorized visibility into user identities and authorizations across the realm.