Description
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Foreman | Foreman | 1.22.0 – < 3.16.2 | 3.16.2 |
| Red Hat | Red Hat Satellite 6.15 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.9.1.14-1.el8sat | RHSA-2025:21897, RHSA-2025:21894, RHSA-2025:21893 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.15.5.7-1.el8sat | RHSA-2025:21897, RHSA-2025:21894, RHSA-2025:21886 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.9.1.14-1.el8sat | RHSA-2025:21897, RHSA-2025:21894, RHSA-2025:21893 |
| Red Hat Satellite Capsule 6 | satellite +2 | 6.15.5.7-1.el8sat | RHSA-2025:21897, RHSA-2025:21894, RHSA-2025:21886 |
| Red Hat Satellite Capsule 6 | satellite-obsolete-packages | 6.18.1-1.el9sat | RHSA-2025:21886 |
| Red Hat Satellite 6 | foreman +14 | 3.9.1.14-1.el8sat | RHSA-2025:21897, RHSA-2025:21894, RHSA-2025:21893 |
| Red Hat Satellite 6 | rubygem-katello | 4.18.0.4-1.el9sat | RHSA-2025:21886 |
| Red Hat Satellite 6 | satellite +2 | 6.15.5.7-1.el8sat | RHSA-2025:21897, RHSA-2025:21894, RHSA-2025:21886 |
| Red Hat Satellite 6 | satellite-obsolete-packages | 6.18.1-1.el9sat | RHSA-2025:21886 |
Advisories 6
- RHSA-2025:21894 Red Hat Security Advisory: Satellite 6.16.5.6 Async Update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2025:21897 Red Hat Security Advisory: Satellite 6.15.5.7 Async Update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2025:21893 Red Hat Security Advisory: Satellite 6.17.6.1 Async Update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2025:21886 Red Hat Security Advisory: Satellite 6.18.1 Async Update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2025-2678 Foreman: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 1, 2026
- WID-SEC-2025-2652 Red Hat Satellite: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 1, 2026
References
- RHSA-2025:21886 vendor-advisory
- RHSA-2025:21893 vendor-advisory
- RHSA-2025:21894 vendor-advisory
- RHSA-2025:21897 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-9572 vdb-entry
- RHBZ#2391715 issue-tracking
- https://theforeman.org/security.html#2025-9572