Authorization Bypass in Candlepin Consumer Registration Module

CVE-2026-111456

What is CVE-2026-111456?

A vulnerability exists in the Candlepin package due to a missing authorization check in the ConsumerResource.setupOwner() function within the consumer registration module. This oversight allows a low-privileged network attacker or user with a valid consumer certificate to register a new consumer in an unauthorized organization by utilizing that organization's key. Consequently, the attacker can obtain an identity certificate for the new consumer, enabling access to the organization's subscription pools and potentially accessing their entitlements if simple content access is not employed.

References