An information disclosure vulnerability exists in keycloak-services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. The issue resides in the GET /admin/realms/{realm}/groups endpoint when the search parameter is used with briefRepresentation=false.
The root cause is improper authorization filtering during the construction of the group hierarchy in the search results. While a delegated admin may be explicitly denied direct access to a parent group (resulting in a 403 Forbidden on direct GET requests), the search mechanism fails to redact the parent group's details when it is returned as part of the hierarchy for a visible child group.
Exploitation Conditions:
FGAP v2 must be enabled.

The attacker must have an account with query-groups permissions.

The attacker must have Groups:view permissions on at least one child group within a restricted parent group.


Concrete Impact:
An attacker can disclose the following information for unauthorized parent groups:
Internal UUIDs and group names.

Custom group attributes (which may contain sensitive metadata).

Role mappings associated with the parent group.