CVE-2026-111456

The Candlepin package contains a missing authorization check in the ConsumerResource.setupOwner() function within the consumer registration module. While the system validates permissions for user-based calls, it fails to perform this check for consumers authenticating via identity certificates . ...