{"id":"CVE-2026-106471","published":"2026-10-07T02:16:57.583","lastModified":"2026-10-07T17:16:48.943","description":"A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-106471","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547044","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Candlepin's authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. This allows low-privilege authenticated attackers to bypass authorization checks and access unauthorized consumer information or modify entitlements across organizations.","exploitability":"Exploitation requires a low-privilege authenticated user who can access the first referenced object, making it moderately difficult to exploit but not requiring complex attack chains.","blast_radius":"The flaw could enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and subscription resources across organizations, potentially affecting multiple tenants in a shared Candlepin deployment.","remediation":"Upgrade to Candlepin 2.590 or later to address this authorization bypass vulnerability.","detection":"Monitor for unusual access patterns where low-privilege users access consumer information or entitlement resources that they should not have access to, particularly when the first accessed resource is a valid target for their permissions.","tags":["auth-bypass","authorization","candlepin","entitlements"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:57:20.546Z"}}