Loading...
Skip to main content
GeekWala

CVE-2026-12515 — Vulnerability in katello — CVE Details

MEDIUM

katello: missing repository authorization in content_uploads exposes cross-product content existence

Published June 17, 2026Updated August 5, 2026Source: osv

Summary

A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.

Advisory Timeline

  • First published June 17, 2026 (117 days ago).
  • Last revised August 5, 2026 — 48 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update katello to 4.21.0.rc1 or later
gem install katello -v 4.21.0.rc1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
katello
rubygems
1.5.0, 2.2.2, 2.4.0, 2.4.0.rc1 (+272 more)4.21.0.rc1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-862
    Missing AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 4.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Frequently Asked Questions

What is CVE-2026-12515?
katello: missing repository authorization in content_uploads exposes cross-product content existence This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 4.3/10).
How do I check if my project is affected by CVE-2026-12515?
CVE-2026-12515 affects katello. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-12515 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
4.3

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-c43c-rf7g-5xpg

Related CVEs

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies