Auth bypass in Red Hat Satellite 6
CVE-2026-79654
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (29.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 29.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-79654 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- github.com/Katello/katello/pull/11847
- projects.theforeman.org/issues/39701
- access.redhat.com/errata/RHSA-2026:74503 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:74504 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:74506 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:74505 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-79654?
- CVE-2026-79654 is a medium-severity vulnerability in Red Hat Satellite 6, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-08-26.
- How severe is CVE-2026-79654?
- Medium severity. CVSS v3 base score is 4.3 out of 10.