CVE-2026-79654 is an authorization bypass vulnerability in Katello's Content View History API. The API does not properly enforce authorization checks when accessing Content Views specified by user input. Consequently, an authenticated user with viewing permissions in one organization may retrieve lifecycle history details of Content Views belonging to other organizations by supplying their identifiers. This flaw leads to unauthorized disclosure of sensitive lifecycle metadata such as publication and promotion events, user associations, and timestamps. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Red Hat has issued an official patch in their RHSA-2026:74503 advisory for Red Hat Satellite 6.19 on RHEL 9.

The vulnerability allows unauthorized disclosure of Content View lifecycle information across organizational boundaries within Katello. This includes sensitive metadata such as publication and promotion events, associated users, and timestamps. There is no indication of impact on integrity or availability. The flaw requires authenticated user privileges with permission to view Content Views in at least one organization.

An official fix is available from Red Hat as detailed in RHSA-2026:74503. Users of Red Hat Satellite 6.19 on RHEL 9 should apply this update to remediate the vulnerability. Prior to applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's documentation for detailed update instructions. No additional mitigation steps are indicated by the vendor advisory.