EUVD-2026-67003
GHSA-593x-2w4f-c2m8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
API is network-reachable (AV:N), requires authenticated low-privilege user (PR:L), no user interaction needed, and impact is bounded to filter-rule disclosure and modification with no availability consequence.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration.
AnalysisAI
Cross-organization IDOR in Katello's Content View Filter Rules API allows authenticated low-privileged users to access and modify filter rules belonging to Content View Filters in other organizations by supplying a foreign filter identifier. Red Hat Satellite 6 deployments running multi-organization configurations are affected, as the API enforces authorization on the Content View but fails to validate the parent Content View Filter's organizational boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session with at least low-privileged Content View permissions in any organization within the targeted Red Hat Satellite 6 instance - anonymous or unauthenticated access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate and context-dependent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged account in Organization A - such as a developer or contractor with Content View read access - enumerates or guesses Content View Filter IDs from Organization B by probing the Content View Filter Rules API with sequential or known identifiers. Because the authorization check stops at the Content View permission boundary rather than the filter's organizational ownership, the API returns or accepts modifications to filter rules from Organization B, allowing the attacker to exfiltrate filter rule details or alter unpublished Content View filter configurations in a foreign organization without detection. … |
| Remediation | Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-81668 for the official patched build - a specific fix version is not independently confirmed from the available data, so the advisory is the authoritative source for patch availability and version targeting. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacema
Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across org
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today