VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Feb 27, 2026· Updated Jun 17, 2026

CVE-2025-9572

CVE-2025-9572

Description

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

16
  • Red Hat/Red Hat Satellite 6.15 for RHEL 8v5
    cpe:/a:redhat:satellite:6.15::el8
    Range: 0:6.15.5.7-1.el8sat
  • Red Hat/Red Hat Satellite 6.17 for RHEL 9v5
    cpe:/a:redhat:satellite_capsule:6.17::el9
    Range: 0:3.14.0.11-1.el9sat
  • Red Hat/Red Hat Satellite 6.18 for RHEL 9v5
    cpe:/a:redhat:satellite_capsule:6.18::el9
    Range: 0:6.18.1-1.el9sat
  • Red Hat/Red Hat Satellite 6.16 for RHEL 9v5
    cpe:/a:redhat:satellite_utils:6.16::el8
    Range: 0:6.16.5.6-1.el9sat
  • Red Hat/Satellite4 versions
    cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite:6.16:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite:6.17:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*
  • Red Hat/Satellite Capsule4 versions
    cpe:2.3:a:redhat:satellite_capsule:6.15:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:satellite_capsule:6.15:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite_capsule:6.16:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite_capsule:6.17:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite_capsule:6.18:*:*:*:*:*:*:*
  • Theforeman/Foreman3 versions
    cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*range: >=1.22.0,<3.16.2
    • (no CPE)
    • (no CPE)range: 1.22.0
  • Red Hat/Enterprise Linux Server
    cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.