Log in Start free

Vulnerability · Published Feb 27, 2026 · Assigned by redhat

CVE-2025-9572Foreman: satellite: graphql api permission bypass leads to information disclosure

Medium 5.0

In plain English

A medium-severity incorrect authorization in Red Hat Satellite 6.15 for RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSruby-foremanno fix listedUBUNTU-CVE-2025-9572
Ubuntu:24.04:LTSruby-foremanno fix listedUBUNTU-CVE-2025-9572
Ubuntu:25.10ruby-foremanno fix listedUBUNTU-CVE-2025-9572
Ubuntu:26.04:LTSruby-foremanno fix listedUBUNTU-CVE-2025-9572

Affected products (as reported)

VendorProductVersions
The Foreman Foreman 1.22.0 – before 3.16.2
Red Hat Red Hat Satellite 6.15 for RHEL 8 see references
Red Hat Red Hat Satellite 6.15 for RHEL 8 see references
Red Hat Red Hat Satellite 6.16 for RHEL 8 see references
Red Hat Red Hat Satellite 6.16 for RHEL 8 see references
Red Hat Red Hat Satellite 6.16 for RHEL 9 see references
Red Hat Red Hat Satellite 6.16 for RHEL 9 see references
Red Hat Red Hat Satellite 6.17 for RHEL 9 see references
Red Hat Red Hat Satellite 6.18 for RHEL 9 see references
Red Hat Red Hat Satellite 6.18 for RHEL 9 see references
Red Hat Red Hat Satellite 6.18 for RHEL 9 see references

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References