CVE-2026-81658: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Satellite 6

The vulnerability in Foreman's template revision endpoint allows an authenticated user with limited template permissions (e.g., view_ptables) to bypass organization and location authorization boundaries by supplying an audit ID. This results in unauthorized disclosure of historical template revisions, which may include sensitive configuration data or credentials. The REST API revision endpoints correctly enforce authorization and are not affected. The issue requires network access to the Foreman web interface and a valid account with template-related permissions. Red Hat rates the impact as moderate with a CVSS 3.1 score of 6.5, primarily due to high confidentiality impact. No temporary workaround meeting Red Hat's standards is known, and customers are advised to apply updates when available.

An authenticated user with low privileges and template-related permissions can access historical template contents belonging to other organizations or locations, potentially exposing sensitive configuration information, credentials, or secrets. The confidentiality impact is high, but integrity and availability are not affected. Exploitation requires network access and valid credentials but no user interaction or special conditions.

Red Hat currently does not have a practical temporary workaround that fully mitigates this issue. Customers should monitor the Red Hat advisory for the release of relevant security updates and apply them promptly once available. No other mitigations are recommended by Red Hat at this time.