Red Hat would like to thank Orionexe for reporting this issue.

Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts