VULNERABILITY INTELLIGENCE

CVE-2025-9572

CVSS score5 MEDIUM
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-02-27
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Description

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Weakness classification

  • secalert@redhat.com: CWE-863
  • nvd@nist.gov: CWE-863

Primary references