Bug 2547044 (CVE-2026-106471)

Summary: CVE-2026-106471 candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, rchan, security-response-team, smallamp, tmalecek
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-06 19:40:00 UTC 
A flaw was found in candlepin. The VerifyAuthorizationFilter.hasAccess method uses a shared boolean that is set true when any verified entity is accessible and is never reset. On REST methods that declare two or more @Verify parameters, authorization failures on later parameters only break an inner loop and do not deny the request if an earlier parameter was accessible. A low-privilege authenticated principal who can access the first verified entity can therefore operate on later entities they are not authorized to access. This affects multiple multi-@Verify API endpoints and can allow cross-Owner (organization) operations when target resource identifiers are known, including listing consumer information, binding to entitlement pools, adding or removing pools on activation keys, and revoking entitlements. Impact is highest on multi-tenant Candlepin deployments such as subscription.rhsm.redhat.com; Satellite is also affected. Reported privately via PSIRTSUPT-24926; keep embargoed pending reporter/customer response on coordinated disclosure.