A flaw was found in candlepin. The VerifyAuthorizationFilter.hasAccess method uses a shared boolean that is set true when any verified entity is accessible and is never reset. On REST methods that declare two or more @Verify parameters, authorization failures on later parameters only break an inner loop and do not deny the request if an earlier parameter was accessible. A low-privilege authenticated principal who can access the first verified entity can therefore operate on later entities they are not authorized to access. This affects multiple multi-@Verify API endpoints and can allow cross-Owner (organization) operations when target resource identifiers are known, including listing consumer information, binding to entitlement pools, adding or removing pools on activation keys, and revoking entitlements. Impact is highest on multi-tenant Candlepin deployments such as subscription.rhsm.redhat.com; Satellite is also affected. Reported privately via PSIRTSUPT-24926; keep embargoed pending reporter/customer response on coordinated disclosure.