services/src/main/java/org/keycloak/protocol/oidc/mappers/ParameterizedScopeUserPropertyMapper.java:80

• This reverses the authorization relationship for the built-in delegation scope. There, the parameter user is the administrator authorized to impersonate the logged-in user, so the logged-in user generally cannot view or impersonate the parameter user; consequently the built-in may_act.sub mapper is suppressed and existing delegation flows fail (for example, TokenExchangeDelegationTest.delegation() expects that claim). Preserve the delegation scope's already-validated impersonation semantics while applying this new check to ordinary username scopes.

            if (!userPermissions.canView(user) && !userPermissions.canImpersonate(user, client)) {
                continue;

services/src/main/java/org/keycloak/protocol/oidc/mappers/ParameterizedScopeUserPropertyMapper.java:81

• This impersonation fallback leaves a disclosure path on ordinary username scopes: an unprivileged requester can target any administrator who can impersonate them, and the mapper will expose that administrator's configured attributes even though the requester cannot view the administrator. Only permit this fallback when the mapper belongs to a validated delegation scope; all other scope types must require userPermissions.canView(user).

            // allow if the current user can view the target, or the target can impersonate the current user (delegation)
            UserPermissionEvaluator targetUserPermissions = AdminPermissions.evaluator(keycloakSession, realm, realm, user).users();
            if (!userPermissions.canView(user) && !targetUserPermissions.canImpersonate(currentUser, client)) {