Description
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
0:11.9.0-5.el10_2 to < *unaffected
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Default version status: affected
0:11.6.0-3.el10_0.1 to < *unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
0:11.7.1-2.el9_8 to < *unaffected
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
Default version status: affected
0:11.6.0-4.el9_6 to < *unaffected
Red Hat Red Hat Certificate System 9
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 6
Default version status: unknown
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
References
- https://access.redhat.com/errata/RHSA-2026:73765 ↗
- https://access.redhat.com/errata/RHSA-2026:73766 ↗
- https://access.redhat.com/errata/RHSA-2026:86621 ↗
- https://access.redhat.com/errata/RHSA-2026:86623 ↗
- https://access.redhat.com/security/cve/CVE-2026-80110 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2523749 ↗