CVE-2025-9572

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Incorrect Authorization pada theforeman foreman, redhat satellite +2 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://theforeman.org/security.html#2025-9572 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:21886 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:21893 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:21894 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:21897 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2025-9572 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2391715 issue tracking