Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2025-9572

Foreman: satellite: graphql api permission bypass leads to information disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The Foreman Foreman

Default version status: unaffected

  • 1.22.0 to < 3.16.2affected

Red Hat Red Hat Satellite 6.15 for RHEL 8

Default version status: affected

  • 0:3.9.1.14-1.el8sat to < *unaffected

Red Hat Red Hat Satellite 6.15 for RHEL 8

Default version status: affected

  • 0:6.15.5.7-1.el8sat to < *unaffected

Red Hat Red Hat Satellite 6.16 for RHEL 8

Default version status: affected

  • 0:3.12.0.12-1.el8sat to < *unaffected

Red Hat Red Hat Satellite 6.16 for RHEL 8

Default version status: affected

  • 0:6.16.5.6-1.el8sat to < *unaffected

Red Hat Red Hat Satellite 6.16 for RHEL 9

Default version status: affected

  • 0:3.12.0.12-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.16 for RHEL 9

Default version status: affected

  • 0:6.16.5.6-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:3.14.0.11-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.18 for RHEL 9

Default version status: affected

  • 0:3.16.0.7-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.18 for RHEL 9

Default version status: affected

  • 0:4.18.0.4-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.18 for RHEL 9

Default version status: affected

  • 0:6.18.1-1.el9sat to < *unaffected

References