This vulnerability arises from incorrect permission assignment for a critical resource in ansible-collection-redhat-leapp. Specifically, when a remediation task that backs up old PostgreSQL data is executed with elevated privileges and the leapp_old_postgresql_data option is enabled, the resulting backup archive in /var/backups is created with world-readable permissions. This misconfiguration permits local non-root users on the managed node to access sensitive PostgreSQL data that should be protected. Exploitation requires local access and the presence of the PostgreSQL data directory at /var/lib/pgsql/data during the remediation task execution. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) and has a CVSS v3.1 base score of 5.5 (medium severity) with a high confidentiality impact but no integrity or availability impact.

The vulnerability allows local non-root users on affected systems to read sensitive PostgreSQL backup data that should be protected. This leads to information disclosure of potentially sensitive database contents. There is no impact on data integrity or availability. Exploitation requires local access and the execution of the specific remediation task with the leapp_old_postgresql_data option enabled.

No official patch or fix is currently confirmed. To mitigate this issue, administrators should ensure that the directory used for PostgreSQL backups (e.g., /var/backups/leapp) is owned by root with restrictive permissions set to 0700, and that the backup archive files themselves have permissions set to 0600. This prevents unauthorized local users from reading the backup data. If the remediation task must be used without modification, local user access on affected systems should be restricted, and any generated backup archives should be immediately removed or have their permissions corrected after creation. These steps reduce the risk of unauthorized data disclosure.