138 matches found
candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
candlepin: Consumer certificate can register systems in another organization
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
candlepin: Consumer certificate can register systems in another organization
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
candlepin: Consumer certificate can register systems in another organization
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
CVE-2026-111456
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
CVE-2026-111456
The Candlepin package contains a missing authorization check in the ConsumerResource.setupOwner() function within the consumer registration module. While the system validates permissions for user-based calls, it fails to perform this check for consumers authenticating via identity certificates . ...
CVE-2026-111456 Candlepin: consumer certificate can register systems in another organization
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
EUVD-2026-124671
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
CVE-2026-111456
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
PT-2026-146031
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
CVE-2026-111456: Red Hat: A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module…
A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...
CVE-2026-106471
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
CVE-2026-106471
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
CVE-2026-106471
A flaw in Candlepin involves broken object-level authorization within the central authorization filter. The system incorrectly grants access if any one of multiple @Verify-annotated parameters is accessible, rather than requiring access to every verified entity. A low-privilege authenticated atta...
CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
EUVD-2026-94155
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...
CVE-2026-106471
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...