VulnerabilityModified
CVE-2025-9572
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions.
MEDIUM 6.5EPSS 0.35%
Does this matter?
Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.
Description
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.35% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- theforeman/foreman · redhat/satellite · redhat/satellite capsule · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2025:21886Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:21893Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:21894Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:21897Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-9572Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2391715Issue Tracking
- https://theforeman.org/security.html#2025-9572Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.