{"id":"CVE-2026-79654","revision":"f2ba6cdc10de429f958ab91b4f50b0e0","records":[{"revision":"f2ba6cdc10de429f958ab91b4f50b0e0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79654","aliases":[],"title":"Ketello: katello content view history api cross-organization authorization bypass","description":"A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.","state":0,"publishedAt":"2026-08-26T05:37:38.45+00:00","modifiedAt":"2026-10-02T17:36:41.175+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rubygem-katello","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6.16 for RHEL 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rubygem-katello\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.14.0.23-1.el8sat\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6.16::el8\",\n                        \"cpe:/a:redhat:satellite:6.16::el9\",\n                        \"cpe:/a:redhat:satellite_capsule:6.16::el8\",\n                        \"cpe:/a:redhat:satellite_capsule:6.16::el9\",\n                        \"cpe:/a:redhat:satellite_utils:6.16::el8\",\n                        \"cpe:/a:redhat:satellite_utils:6.16::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rubygem-katello","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6.16 for RHEL 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rubygem-katello\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.14.0.23-1.el9sat\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6.16::el8\",\n                        \"cpe:/a:redhat:satellite:6.16::el9\",\n                        \"cpe:/a:redhat:satellite_capsule:6.16::el8\",\n                        \"cpe:/a:redhat:satellite_capsule:6.16::el9\",\n                        \"cpe:/a:redhat:satellite_utils:6.16::el8\",\n                        \"cpe:/a:redhat:satellite_utils:6.16::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rubygem-katello","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6.17 for RHEL 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rubygem-katello\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.16.0.20-1.el9sat\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6.17::el9\",\n                        \"cpe:/a:redhat:satellite_capsule:6.17::el9\",\n                        \"cpe:/a:redhat:satellite_utils:6.17::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rubygem-katello","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6.18 for RHEL 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rubygem-katello\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.18.0.24-1.el9sat\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6.18::el9\",\n                        \"cpe:/a:redhat:satellite_capsule:6.18::el9\",\n                        \"cpe:/a:redhat:satellite_utils:6.18::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rubygem-katello","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6.19 for RHEL 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rubygem-katello\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:4.20.0.11-1.el9sat\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6.19::el9\",\n                        \"cpe:/a:redhat:satellite_capsule:6.19::el9\",\n                        \"cpe:/a:redhat:satellite_utils:6.19::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"satellite:el8/rubygem-katello","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"satellite:el8/rubygem-katello\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"tfm-rubygem-katello","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Satellite 6\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"tfm-rubygem-katello\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:satellite:6\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://access.redhat.com/errata/RHSA-2026:74503","https://access.redhat.com/errata/RHSA-2026:74504","https://access.redhat.com/errata/RHSA-2026:74505","https://access.redhat.com/errata/RHSA-2026:74506","https://access.redhat.com/security/cve/CVE-2026-79654","https://bugzilla.redhat.com/show_bug.cgi?id=2523348","https://github.com/Katello/katello/pull/11847","https://projects.theforeman.org/issues/39701"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79654","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79654","identifiers":["CVE-2026-79654"]},"retained":false,"historicalAffected":[]}],"coverage":[]}