A Missing Authorization flaw was found in the SCIM user listing endpoint (GET /realms/{realm}/scim/v2/Users) of Keycloak. The endpoint only verifies if the calling principal holds the query-users role but fails to enforce per-user VIEW authorization checks, which are correctly enforced by other SCIM and Admin REST endpoints. This is a regression caused by the removal of a protection layer during a previous fix for Fine-Grained Admin Permissions (FGAP) v2.
Exploitation requires the SCIM API to be enabled, the realm attribute scimApiEnabled to be set to true, and the realm to be using the default role-based permission model. An attacker must also possess a valid bearer token with the query-users role and a specific audience claim. Successful exploitation allows an attacker to retrieve full PII (including email, name, and custom attributes) for every non-admin local user in the realm.