CVE-2026-107203: Incorrect Authorization in Red Hat Red Hat Satellite 6

This vulnerability arises because the domain and subnet interface API in Foreman only checks that the caller has host permission but fails to enforce search limits on that permission. Consequently, a user allowed to view some hosts and a domain or subnet shared with other hosts can retrieve interface data for all hosts in that domain or subnet, including those they are not authorized to view. Furthermore, users with edit permissions on some hosts can submit changes to interfaces outside their authorized scope, which are then saved. This incorrect authorization flaw compromises confidentiality and integrity of host interface data within Red Hat Satellite 6 environments.

An attacker or low-privileged user who can view some hosts and a shared domain or subnet can access interface records of unauthorized hosts, leading to information disclosure. If the attacker also has edit permissions on some hosts, they can modify interfaces of unauthorized hosts, potentially impacting system configuration integrity. There is no indication of availability impact. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.4.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-107203 for current remediation guidance. Until an official fix is available, restrict permissions to view and edit hosts and domains/subnets to trusted users only to minimize exposure.