Insufficient Authorization Flaw in Red Hat Satellite's Content Upload Functionality

CVE-2026-12515

What is CVE-2026-12515?

A security flaw exists in the ContentUploadsController of Red Hat Satellite, where insufficient authorization checks allow users with edit_products permissions to access content information from repositories beyond their authorized scope. An authenticated attacker could exploit this vulnerability to discover the existence of specific content in otherwise restricted repositories, posing a potential information disclosure risk. Importantly, this issue does not permit unauthorized modifications, imports, or content publication.

References