CVE-2025-9572

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2025:21886	Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:21893	Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:21894	Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:21897	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-9572	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2391715	Issue Tracking
https://theforeman.org/security.html#2025-9572	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:satellite:6.15:::::::*
	cpe:2.3:a:redhat:satellite:6.16:::::::*
	cpe:2.3:a:redhat:satellite:6.17:::::::*
	cpe:2.3:a:redhat:satellite:6.18:::::::*
	cpe:2.3:a:redhat:satellite_capsule:6.15:::::::*
	cpe:2.3:a:redhat:satellite_capsule:6.16:::::::*
	cpe:2.3:a:redhat:satellite_capsule:6.17:::::::*
	cpe:2.3:a:redhat:satellite_capsule:6.18:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

History

No history.

Information

Published : 2026-02-27 08:17

Updated : 2026-03-24 12:16

NVD link : CVE-2025-9572

Mitre link : CVE-2025-9572

CVE.ORG link : CVE-2025-9572

JSON object : View

Products Affected

redhat

satellite
satellite_capsule
enterprise_linux

theforeman

foreman

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-9572", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2026-02-27T08:17:06.373", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:21886", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:21893", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:21894", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:21897", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-9572", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391715", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}, {"url": "https://theforeman.org/security.html#2025-9572", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass."}, {"lang": "es", "value": "Una falla de autorizaci\u00f3n en la API GraphQL de Foreman permite a usuarios con bajos privilegios acceder a metadatos m\u00e1s all\u00e1 de sus permisos asignados. A diferencia de la API REST, que aplica correctamente los controles de acceso, el endpoint GraphQL no aplica un filtrado adecuado, lo que lleva a una omisi\u00f3n de autorizaci\u00f3n."}], "lastModified": "2026-03-24T12:16:12.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D99F6FA-1E2E-4914-A644-C114F9780C16", "versionEndExcluding": "3.16.2", "versionStartIncluding": "1.22.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F12DC81-33E9-4693-8636-7A1AD20D5CA1"}, {"criteria": "cpe:2.3:a:redhat:satellite:6.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD7B59EF-75E0-41FE-A5D6-BCE41107E2D6"}, {"criteria": "cpe:2.3:a:redhat:satellite:6.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "342183ED-1495-4481-9164-B3ED8424B618"}, {"criteria": "cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2205338-7476-46DC-ABB2-52F0BBAAD01D"}, {"criteria": "cpe:2.3:a:redhat:satellite_capsule:6.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "142F6FF2-B450-4309-B56A-6B8C0640E2D3"}, {"criteria": "cpe:2.3:a:redhat:satellite_capsule:6.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB9D21EC-ABF6-49AC-A353-5A5BEAA5EE03"}, {"criteria": "cpe:2.3:a:redhat:satellite_capsule:6.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C3723A5-FB16-4259-BABF-918506E2CF05"}, {"criteria": "cpe:2.3:a:redhat:satellite_capsule:6.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9B1769A-37F4-40CB-B613-7B60C4F63D4D"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}