CVEvulnerability

CVE-2025-9572

6.5 MEDIUM Published 2026-02-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2026-02-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863

Description

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Affected configurations

• theforeman foreman (>= 1.22.0 < 3.16.2) • redhat satellite 6.15 • redhat satellite 6.16 • redhat satellite 6.17 • redhat satellite 6.18 • redhat satellite capsule 6.15 • redhat satellite capsule 6.16 • redhat satellite capsule 6.17 • redhat satellite capsule 6.18 • redhat enterprise linux 9.0

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References