A flaw was found in the Keycloak Admin UI extension. The GET /admin/realms/{realm}/ui-ext/brute-force-user?search=id:{userId} endpoint fails to correctly enforce Fine-Grained Admin Permissions v2 (FGAPv2) user view restrictions. Specifically, the BruteForceUsersResource.java component skips the usersEvaluator::canView filter when processing the search=id: code path.
An authenticated attacker with the query-users client role from realm-management can exploit this vulnerability to retrieve full user representations, including Personally Identifiable Information (PII) and brute-force metadata, for any user whose ID they know or can obtain. This bypasses the intended restriction where such an admin should only be able to view users they have explicit view permissions for under FGAPv2.