Description
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Cluster 5 | luci +2 | 0.12.2-81.el5 | RHSA-2014:1194 |
Advisories 1
- RHSA-2014:1194 Red Hat Security Advisory: conga security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1112813
- RHSA-2014:1194 vendor-advisory