Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107193— Foreman: api filter lookup ignores a search-limited filter permission

Quick assessment

Affected
Red Hat Red Hat Satellite 6
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 foreman 软件包中发现了一个关于权限过滤器（permission filters）的缺陷。该 API 通过标识符加载过滤器，但未对调用者的权限施加搜索限制。如果低权限的网络攻击者或用户已被允许仅删除某一角色的过滤器，他们就可以删除属于其他未锁定角色的过滤器。这会导致这些其他角色失去由已删除过滤器所授予的访问权限。

CVSS 6.5 · Medium EPSS 0.18% · P7

Affected Version Matrix 1

VendorProduct Version RangeStatus
Red Hat Red Hat Satellite 6 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107193

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Foreman: api filter lookup ignores a search-limited filter permission
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Satellite 6 - cpe:/a:redhat:satellite:6

II. Public POCs for CVE-2026-107193

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107193

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-107193 (2)

Same Patch Batch · Red Hat · 2026-10-12 · 12 CVEs total

CVE-2026-87744 9.1 CRITICAL Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest
CVE-2026-108094 7.8 HIGH Mutter: mutter: client-triggered use-after-free in wayland color-management icc image desc
CVE-2026-75888 7.7 HIGH Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch
CVE-2026-83535 7.4 HIGH Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-ti
CVE-2026-109082 6.8 MEDIUM Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for pub
CVE-2026-94451 6.5 MEDIUM Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: informat
CVE-2026-85471 6.4 MEDIUM Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable
CVE-2026-109194 6.4 MEDIUM Quay: build trigger uuid idor in quay api
CVE-2026-107203 5.4 MEDIUM Foreman: domain and subnet interface api skips host search filters
CVE-2026-83536 5.3 MEDIUM Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)
CVE-2026-109195 3.1 LOW Quay: repository auto-prune policy uuid idor in quay api

IV. Related Vulnerabilities

Same product: Red Hat Satellite 6
Same vendor: Red Hat
Same weakness: CWE-639

V. Comments for CVE-2026-107193

No comments yet

Leave a comment