EUVD-2026-124671

A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...

CVE-2026-111456

The Candlepin package contains a missing authorization check in the ConsumerResource.setupOwner() function within the consumer registration module. While the system validates permissions for user-based calls, it fails to perform this check for consumers authenticating via identity certificates . ...