CVE-2026-56098 describes an authorization bypass vulnerability in the RegistryProxiesController of rubygem-katello. The flaw arises because the unauthorized method triggers an error response but does not halt further execution due to a missing return statement in the registry_authorize filter. This allows the application to proceed with business logic and database validation filters, enabling an attacker with limited privileges to enumerate internal resources such as Users, Organizations, and Products across the instance. The vulnerability is tracked with a CVSS 3.1 base score of 4.3 (medium severity). Red Hat's advisory (RHSA-2026:74503) confirms an official fix is available for Red Hat Satellite 6.19 on RHEL 9.

The vulnerability allows an attacker with limited privileges to bypass authorization controls and enumerate sensitive internal resources, including Users, Organizations, and Products. This information disclosure could aid further targeted attacks or reconnaissance but does not directly lead to integrity or availability impacts. The CVSS score reflects a low complexity attack vector with network access and no user interaction required.

An official fix is available from Red Hat as detailed in advisory RHSA-2026:74503. Users of Red Hat Satellite 6.19 on RHEL 9 should apply the update to remediate this vulnerability. No additional mitigation steps are required beyond applying the vendor-provided patch.