← CVE Intelligence

CVE-2025-9572

Foreman: satellite: graphql api permission bypass leads to information disclosure PUBLISHED

Description (CNA)

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Affected (CNA)

Vendor / productVersions
The Foreman / Foremanaffected 1.22.0 before 3.16.2
Red Hat / Red Hat Satellite 6.15 for RHEL 8unaffected 0:3.9.1.14-1.el8sat before *
Red Hat / Red Hat Satellite 6.15 for RHEL 8unaffected 0:6.15.5.7-1.el8sat before *
Red Hat / Red Hat Satellite 6.16 for RHEL 8unaffected 0:3.12.0.12-1.el8sat before *
Red Hat / Red Hat Satellite 6.16 for RHEL 8unaffected 0:6.16.5.6-1.el8sat before *
Red Hat / Red Hat Satellite 6.16 for RHEL 9unaffected 0:3.12.0.12-1.el9sat before *
Red Hat / Red Hat Satellite 6.16 for RHEL 9unaffected 0:6.16.5.6-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.14.0.11-1.el9sat before *
Red Hat / Red Hat Satellite 6.18 for RHEL 9unaffected 0:3.16.0.7-1.el9sat before *
Red Hat / Red Hat Satellite 6.18 for RHEL 9unaffected 0:4.18.0.4-1.el9sat before *
Red Hat / Red Hat Satellite 6.18 for RHEL 9unaffected 0:6.18.1-1.el9sat before *

CWE

CWE-863

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.