A missing authorization check in the ConsumerResource.setupOwner() function of the Candlepin consumer registration module allows a low-privileged attacker with a valid consumer certificate from one organization to register a new consumer in a different organization by supplying that organization's key. This flaw enables the attacker to obtain an identity certificate for the new consumer, view the target organization's subscription pools, and potentially attach entitlements if simple content access is not used. The vulnerability affects Candlepin versions from 0.4.7 onward and all Red Hat Satellite versions 6.16 through 6.19, which ship affected Candlepin versions.