EUVD-2026-48615
GHSA-jq46-23h4-vfpj
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Network attack vector, high complexity due to need for known certificate identifier, low privilege required, no user interaction, low integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
AnalysisAI
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have an active, authenticated session in the Certificate System (e.g., as a user of realm A) and must know the serial number or certificate ID of a target certificate belonging to a different realm. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base score 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-attackable but high complexity, low privileges required, and only low integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user of realm A (e.g., an internal employee) sends a crafted renewal request for a certificate originally issued to realm B, using the certificate's serial number or ID. Because the renewal servlet lacks realm validation, the certificate is renewed without authorization from realm B's administrators, potentially extending its validity in an unauthorized manner. |
| Remediation | Apply the upstream commit e2de26769761af04b9c56071bd1a1926903c49b6, which adds realm-based authorization checks to the EnrollmentProcessor (and by extension the renewal path). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today