EUVD-2026-66252
GHSA-xqhp-pxqr-f7m6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable API requires authenticated low-privilege account; IDOR yields read-only metadata disclosure with no integrity or availability impact and no scope change.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.
AnalysisAI
Cross-organizational information disclosure in Katello - the content management engine of Red Hat Satellite 6 - allows any authenticated user to read lifecycle history of Content Views belonging to organizations other than their own. By supplying an arbitrary Content View identifier to the Content View History API endpoint, a low-privileged user bypasses organization-scope authorization and retrieves publication events, promotion history, associated usernames, and timestamps for foreign tenants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session to the Red Hat Satellite 6 API with at minimum the 'view Content Views' permission granted in any organization on the instance - no administrative rights are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes this as a low-complexity, network-reachable flaw that any authenticated Satellite user can attempt without elevated privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patched release of Red Hat Satellite 6 when made available via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-79654. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across org
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacema
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today