CVE-2026-106471: Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.
Other sources
A flaw was found in candlepin. The VerifyAuthorizationFilter.hasAccess method uses a shared boolean that is set true when any verified entity is accessible and is never reset. On REST methods that declare two or more @Verify parameters, authorization failures on later parameters only break an inner loop and do not deny the request if an earlier parameter was accessible. A low-privilege authenticated principal who can access the first verified entity can therefore operate on later entities they are not authorized to access. This affects multiple multi-@Verify API endpoints and can allow cross-Owner (organization) operations when target resource identifiers are known, including listing consumer information, binding to entitlement pools, adding or removing pools on activation keys, and revoking entitlements. Impact is highest on multi-tenant Candlepin deployments such as subscription.rhsm.redhat.com; Satellite is also affected. Reported privately via PSIRTSUPT-24926; keep embargoed pending reporter/customer response on coordinated disclosure.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Can an unauthenticated attacker exploit this issue?
No. Exploitation requires a low-privilege authenticated principal that can access the first verified object referenced by a vulnerable REST method.
What additional conditions are needed for cross-organization access or modification?
The attacker needs to target a REST endpoint with two or more @Verify parameters and know the identifiers of later resources. Access to an earlier verified entity can cause authorization failures for subsequent entities to be ignored, including for resources in another organization.
Which resources may be exposed or changed?
The issue can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources. Affected operations may span different owners or organizations.