Description
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.26-1.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Maintenance 6 | ansible-core | 1:2.16.19-4.el9sat | RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite Capsule 6 | ansible-core +1 | 1:2.16.19-4.el9sat | RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.26-1.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.26.9-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python-pulpcore +1 | 3.49.39-5.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python-pyjwt +2 | 2.15.1-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python-pysequoia +1 | 0.1.35-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python3.12-pulp-rpm | 3.29.12-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | python3.12-pulpcore | 3.73.45-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.15.1-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | python3.12-pysequoia | 0.1.35-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_dynflow | 0.9.3-2.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite 6 | ansible-core +1 | 1:2.16.19-4.el9sat | RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | candlepin +1 | 4.4.26-2.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.26-1.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.26.9-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python-pulpcore +1 | 3.49.39-5.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python-pyjwt +2 | 2.15.1-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python-pysequoia +1 | 0.1.35-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python3.12-pulp-rpm | 3.29.12-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite 6 | python3.12-pulpcore | 3.73.45-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.15.1-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite 6 | python3.12-pysequoia | 0.1.35-1.el9pc | RHSA-2026:99952 |
| Red Hat Satellite 6 | rubygem-crass | 1.0.8-1.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | rubygem-katello | 4.14.0.24-1.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | rubygem-puma | 6.4.3-2.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | rubygem-safemode | 1.5.0-3.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | rubygem-smart_proxy_dynflow | 0.9.3-2.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
Advisories 4
- RHSA-2026:99952 Red Hat Security Advisory: Satellite 6.18.11 Async Update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:99949 Red Hat Security Advisory: Satellite 6.16.15 Async Update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:99950 Red Hat Security Advisory: Satellite 6.17.13 Async Update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- WID-SEC-2026-3868 Foreman: Schwachstelle ermöglicht Manipulation von Dateien und Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 12, 2026
References
- RHSA-2026:99949 vendor-advisory
- RHSA-2026:99950 vendor-advisory
- RHSA-2026:99952 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-107193 vdb-entry
- RHBZ#2547437 issue-tracking