Search: CVE-2026-106471

CVE-2026-106471 is an authorization flaw in Candlepin, a component of Red Hat Satellite 6.16 for RHEL 8. The central authorization filter incorrectly grants access if any one of multiple verified parameters is accessible, rather than requiring access to all. This allows a low-privilege authenticated attacker who can access one referenced object to bypass authorization checks on others. When resource identifiers are known, this can lead to unauthorized disclosure and modification of consumer information, entitlements, and subscription resources across organizational boundaries. The vulnerability is particularly impactful in multi-tenant deployments.