Read the docs
TI-2026-69060 Aliases CVE-2026-106471GHSA-993v-gm7c-q4cq

Broken authorization in Candlepin lets users access other objects

Priority LOW 37CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

Candlepin, the component in Red Hat Satellite 6, has a central authorization filter that grants access when any one of several verified parameters is accessible instead of requiring access to all of them. An authenticated attacker with low privileges who can access the first referenced object can reach subsequent objects (CWE-863). If the target identifiers are known, the attacker can read consumer information and modify entitlements and subscription resources, including across organizations.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Satellite 6——No fix listedCNA
  • Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:/a:redhat:satellite:66—Red Hat
  • cpe:/a:redhat:satellite:6 Versions 6 — ·Red Hat

Remediation

Red Hat lists Red Hat Satellite 6 as affected with its plan set to none available. The sources list no fixed version for Red Hat Satellite 6.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-106471
  2. 2026-10-07 Alias added: GHSA-993v-gm7c-q4cq
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-07 CVSS score added · Red Hat
  5. 2026-10-07 CISA SSVC decision points changed
  6. 2026-10-07 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences