CVE-2025-9572 Foreman: satellite: graphql api permission bypass leads to information disclosure
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization
Affected products: vendor: The Foreman
product: Foreman
default_status: unaffected
vendor: Red Hat
product: Red Hat Satellite 6.15 for RHEL 8
cpes: cpe:/a:redhat:satellite:6.15::el8
cpe:/a:redhat:satellite_utils:6.15::el8
cpe:/a:redhat:satellite_capsule:6.15::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.15 for RHEL 8
cpes: cpe:/a:redhat:satellite:6.15::el8
cpe:/a:redhat:satellite_utils:6.15::el8
cpe:/a:redhat:satellite_capsule:6.15::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.16 for RHEL 8
cpes: cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.16 for RHEL 8
cpes: cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.16 for RHEL 9
cpes: cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.16 for RHEL 9
cpes: cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.18 for RHEL 9
cpes: cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_utils:6.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.18 for RHEL 9
cpes: cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_utils:6.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.18 for RHEL 9
cpes: cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_utils:6.18::el9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Ohad Levy (Redhat) for reporting this issue.
Published: 2026-02-27T07:28:44.391Z