Threats tagged 'ghsa-993v-gm7c-q4cq'

CVE-2026-106471 is a vulnerability in Candlepin's central authorization filter where access is incorrectly granted if any one of multiple verified parameters is accessible, rather than requiring access to all. This flaw allows a low-privilege authenticated attacker who can access one referenced object to bypass authorization checks on other objects. If the attacker knows target resource identifiers, they can disclose consumer information and modify entitlements and subscription resources, potentially across organizations. The vulnerability has a high CVSS score of 8.1, indicating significant confidentiality and integrity impact. A security update addressing this flaw is available from Red Hat as part of Red Hat Satellite 6.16 updates for RHEL 8 and 9.