CVE-2026-111456

A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...