The vulnerability in Red Hat Satellite 6 arises from improper validation of role assignments in the Foreman Usergroup model. Authenticated users who have permissions to manage user groups can exploit this flaw to attach any role, including administrative roles, to a user group and add themselves as members. This leads to privilege escalation to administrator level. The CVSS 3.1 score is 8.8 (high severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, and significant impact on confidentiality, integrity, and availability. No patch or official remediation level is currently stated in the vendor advisory, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation allows an authenticated user with usergroup management permissions to escalate privileges to administrator level, potentially compromising the entire system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5136 for current remediation guidance. Until an official fix is available, restrict usergroup management permissions to trusted users only to reduce risk.