CVE-2026-79654— Ketello: katello content view history api cross-organization authorization bypass
Quick assessment
Affected
Red Hat Red Hat Satellite 6
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Katello 中发现一个安全漏洞：Content View History API 在用户指定访问某一 Content View 时，未能正确实施授权检查。拥有查看某一组织内 Content View 权限的已认证用户，可以通过向受影响的 API 端点提供另一组织中 Content View 的标识符，访问该 Content View 的生命周期历史。这可能导致未授权地泄露 Content View 的生命周期信息，包括发布和推送事件、关联用户以及时间戳等。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79654
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ketello: katello content view history api cross-organization authorization bypass
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
II. Public POCs for CVE-2026-79654
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79654
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-79654 (1)
Vendor Advisories for CVE-2026-79654 (2)
Other References for CVE-2026-79654 (1)
IV. Related Vulnerabilities
Same vendor: Red Hat
-
CVE-2026-80158
Ansible-collection-community-general: community.general: ipa -
CVE-2026-80185
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent- -
CVE-2026-80186
Bluez: stack overflow in name2utf8 causes dos and potential -
CVE-2026-77680
Libsoup3: libsoup: quadratic cpu denial of service in http r -
CVE-2026-79992
Emacs: local shell command injection through the user field
Same weakness: CWE-639
-
CVE-2026-69129
KubePi: Insufficient per-cluster authorization checks in clu -
CVE-2026-65642
Plesk 18.0.79.7及18.0.80.3前存在IDOR漏洞 -
CVE-2026-77368
SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Hand -
CVE-2026-55228
Weblate:: WebIDOR in GroupViewSet allows authenticated proje -
CVE-2026-74771
Dell PowerProtect One 20.1.0及以下用户可控密钥认证绕过
V. Comments for CVE-2026-79654
No comments yet