A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote… (CVE-2026-107445)

CVE-2026-107445 describes an authorization bypass vulnerability in Katello's Flatpak Remote Repositories API. The API does not properly enforce authorization checks when accessing flatpak remote repositories by identifier, allowing an authenticated user with limited permissions scoped to one organization to access repository information belonging to other organizations. The same unscoped lookup mechanism is used by the mirror action, which could allow the user to create a repository in a product they can edit but that is configured with another organization's flatpak remote URL and stored credentials. This issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An authenticated user with permission to view flatpak remotes in one organization can access sensitive flatpak remote repository information from other organizations, potentially exposing confidential data. Furthermore, the user may be able to create or modify repositories in a way that uses another organization's remote URLs and credentials, which could lead to unauthorized access or misuse of those credentials. The vulnerability has a CVSS v3.1 base score of 5.4 (medium severity), indicating limited confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to view flatpak remotes to trusted users only and monitor for unusual repository creation or modification activities involving flatpak remotes. Avoid sharing credentials across organizations and review repository configurations for unauthorized changes.