A flaw was found in the Keycloak Admin REST API when Fine-Grained Admin Permissions (FGAP) v2 is enabled. The default-groups endpoint and the general realm representation do not correctly enforce per-group view permission checks for default groups. A delegated administrator who has been granted realm-level view permissions but is explicitly denied view permissions for specific groups can still enumerate those hidden groups. By accessing the admin/realms/{realm}/default-groups or admin/realms/{realm} endpoints, the attacker can recover group names, UUIDs, and paths. This allows an authenticated attacker to map out the authorization topology, including onboarding structures, privilege levels, or tenant information that should remain restricted.