https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 09:38:38 +0000 https://db.gcve.eu/vuln/cve-2026-111456 <p><strong>Affected:</strong> Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9</p> <p>A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization&#39;s key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization&#39;s subscription pools. When the organization is not using simple content access, the attacker can attach that organization&#39;s entitlements to the new consumer.</p> <p><strong>Affected:</strong> Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9</p> <p>A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization&#39;s key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization&#39;s subscription pools. When the organization is not using simple content access, the attacker can attach that organization&#39;s entitlements to the new consumer.</p> https://db.gcve.eu/vuln/cve-2026-111456