Insufficient Authorization Flaw in Red Hat Satellite's Content Upload Functionality
CVE-2026-12515
4.3MEDIUM
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 17 June 2026
What is CVE-2026-12515?
A security flaw exists in the ContentUploadsController of Red Hat Satellite, where insufficient authorization checks allow users with edit_products permissions to access content information from repositories beyond their authorized scope. An authenticated attacker could exploit this vulnerability to discover the existence of specific content in otherwise restricted repositories, posing a potential information disclosure risk. Importantly, this issue does not permit unauthorized modifications, imports, or content publication.
Affected Version(s)
Red Hat Satellite 6.16 for RHEL 8 0:4.14.0.21-1.el8sat
Red Hat Satellite 6.16 for RHEL 9 0:4.14.0.21-1.el9sat
Red Hat Satellite 6.17 for RHEL 9 0:4.16.0.18-1.el9sat