CVE search · CVE-2025-9572
CVE-2025-9572
medium 6.5
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
Details
- Status
- Modified
- Published
- Last changed
- Source
- secalert@redhat.com
- Weakness
- CWE-863
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
secalert@redhat.comSecondary |
| CVSS 3.1 | medium 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- theforeman · foreman
- redhat · satellite
- redhat · satellite_capsule
- redhat · enterprise_linux
References
- https://access.redhat.com/errata/RHSA-2025:21886Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:21893Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:21894Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:21897Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-9572Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2391715Issue Tracking
- https://theforeman.org/security.html#2025-9572Vendor Advisory