Katello EUVD-2026-94693

Requires an authenticated Satellite/Katello account that already holds permission to view flatpak remotes in at least one organization (PR:L), and a multi-organization deployment where another organization has configured Flatpak remote repositories with stored remote credentials. Exploitation is limited by: the attacker needing a valid account with the flatpak-remote view permission; the Flatpak remote repository feature actually being in use; a multi-tenant (multiple organization) configuration; and, for the credential-reuse path, the user having edit rights to a product in which to create the mirrored repository. Single-organization deployments and instances not using Flatpak remotes are not exposed.

This is a moderate-severity, authenticated authorization flaw (CWE-639, insecure direct object reference) and should be treated as a medium-priority patch rather than an emergency. The vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) indicates network-reachable exploitation over the Katello/Satellite API with low attack complexity and no user interaction, but it explicitly requires an authenticated account (PR:L) - specifically a user already holding permission to view flatpak remotes in at least one organization. Exploitation status is 'no public exploit identified at time of analysis': this CVE is not in CISA KEV, no POC is referenced, and no EPSS score was provided in the input, so there is no signal of active or widespread exploitation. The signals are internally consistent - a cross-tenant isolation bug in a multi-org enterprise product is a classic insider/tenant-boundary risk rather than an internet-wide mass-exploitation target - but the real aggravating factor is data sensitivity: beyond cross-organization information disclosure, the same unscoped lookup lets the mirror action reuse ANOTHER organization's stored remote credentials, which the base C:L rating arguably understates. EPSS is absent, so probability of exploitation cannot be quantified; verify against the Red Hat advisory for an authoritative score.

In a multi-organization Red Hat Satellite deployment, a user who has only low-privilege flatpak-remote permissions in Organization A authenticates to the Flatpak Remote Repositories API and references a repository by identifier that actually belongs to Organization B, retrieving its remote repository details. They then invoke the mirror action to create a repository in a product they can edit, which is silently configured with Organization B's flatpak remote URL and stored remote credentials. No public exploit code is identified, but the attack is trivial to script given valid credentials and knowledge or enumeration of a target identifier.