CVE-2026-81668: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Satellite 6

The vulnerability exists because the Content View Filter Rules API in Katello does not properly enforce authorization checks on the parent Content View Filter. An authenticated user with Content View permissions in one organization can supply the identifier of a Content View Filter belonging to another organization and thereby access or modify its filter rules. This bypasses intended authorization boundaries between organizations within Red Hat Satellite 6.

An attacker with low privileges in one organization can gain unauthorized read and write access to Content View Filter rules in other organizations. This results in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configurations. There is no indication of impact on system availability or privilege escalation beyond Content View permissions.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-81668 for current remediation guidance. No vendor-provided patch or workaround information is included in the available data.