CVE-2025-9572
Foreman: satellite: graphql api permission bypass leads to information disclosure
Résumé
Foreman: satellite: graphql api permission bypass leads to information disclosure
Description d'origine
La description telle que publiée par la source (souvent en anglais).
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Ubuntu UBUNTU-CVE-2025-9572 ruby-foreman
Références
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report bugzilla.redhat.com
- web access.redhat.com
- web theforeman.org