CVE-2026-107445: Rubygem-katello: katello flatpak remote repositories api cross-organization authorization bypass
A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository information belonging to another organization. The same unscoped lookup is used by the mirror action, which may allow creating a repository in a product the user can edit that is configured with another organization's flatpak remote URL and stored remote credentials.
Other sources
A flaw was found in Katello. The Flatpak Remote Repositories API resolves records with an unscoped FlatpakRemoteRepository.find in a beforeaction used by show and mirror, while the index path correctly uses FlatpakRemoteRepository.readable. An authenticated user with viewflatpakremotes in one organization can read another organization's flatpak remote repository metadata. The same unscoped finder backs the mirror action, which creates a repository in a product the attacker can edit using the victim organization's flatpak remote registry URL and stored remote credentials (username/token). Reported via PSIRTSUPT-25121.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated and have permission to view Flatpak remotes in at least one organization. To use the mirror action to create a repository, they also need permission to edit a product.
What can an attacker access or change across organizations?
They may read Flatpak remote repository metadata belonging to another organization. Through the mirror action, they may create a repository in a product they can edit using another organization's remote registry URL and stored remote credentials, such as a username or token.
Which API paths are affected?
The unscoped lookup is used by the show and mirror actions. The index path uses a scoped readable lookup and is described as correctly enforcing access restrictions.