Keycloak Admin REST CVE-2025-14082

This vulnerability presents minimal real-world risk despite its assignment as an information disclosure issue. The CVSS 2.7 score correctly reflects low impact (confidentiality only, no integrity or availability impact). The EPSS score of 0.01% (1st percentile) indicates extremely low likelihood of exploitation in the wild. The attack vector is network-accessible (AV:N) with low complexity (AC:L), but critically requires high-privilege authentication (PR:H), meaning only administrators or users with elevated roles can exploit it. This significantly reduces the threat surface compared to unauthenticated or low-privilege vulnerabilities. The sensitivity of disclosed information is constrained to role metadata rather than secrets or credentials. Per SSVC framework, this ranks as low-priority: exploitation requires privileged access, is not automatable across systems, and technical impact is limited to information disclosure. Organizations should prioritize patching higher-CVSS vulnerabilities first.

An administrator with high-privilege access to a Keycloak instance queries the /admin/realms/{realm}/roles endpoint and retrieves role metadata (names, descriptions, or other sensitive attributes) for roles outside their delegated administrative scope, potentially discovering organizational structure, permissions hierarchy, or role assignments they should not have visibility into. The attack requires network access and valid high-privilege credentials, making it applicable only in environments where privilege separation is desired but not technically enforced.