CVE-2025-9572
Foreman: satellite: graphql api permission bypass leads to information disclosure
Summary
Foreman: satellite: graphql api permission bypass leads to information disclosure
Original description
The description as published by the source.
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2025-9572 ruby-foreman
References
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report bugzilla.redhat.com
- web access.redhat.com
- web theforeman.org