CVE-2026-12515— Red Hat Hardened Images 授权问题漏洞

Katello: missing repository authorization in content_uploads exposes cross-product content existence

A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

授权机制缺失

Red Hat Hardened Images 授权问题漏洞

Red Hat Red Hat Hardened Images是美国Red Hat公司的容器镜像。 Red Hat Hardened Images 6存在授权问题漏洞，该漏洞源于ContentUploadsController中授权检查不足，允许拥有edit_products权限的用户查询其授权管理产品之外存储库的内容信息，可能导致经过身份验证的攻击者确定原本无法访问的存储库中是否存在特定内容。以下版本受到影响：Red Hat Hardened Images和Red Hat Satellite 6。

N/A

N/A