Acknowledgments:

Name: Jean-Baptiste Dancre (Saint-Gobain DSI Groupe)

CVSS Justification
====================
AV: N -> Exploited over the Satellite web UI/API; no local access needed.
AC: L -> No special conditions beyond a normal multi-org role/filter setup; attacker uses the product as designed.
PR: L -> Requires an authenticated non-admin account with some organization-scoped permissions, not full admin.
UI: N -> Attacker can exploit this alone with their own session; no other user interaction required.
S: U -> Impact stays within Satellite’s authorization boundary; org crossover does not change a separate security authority.
C: H -> Attacker can view organization-scoped resources and data outside the intended permission scope.
I: L -> Limited modification possible if the overly broad filter includes write permissions; not full system integrity compromise.
A: N -> No meaningful impact on availability.