A flaw in Candlepin caused the verifyauthorizationfilter to grant access when any one of multiple @Verify-annotated parameters was accessible, instead of requiring access to every verified entity. This flaw represents a CWE-863 (Broken Object‑Level Authorization) vulnerability. As a result, a low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this enables unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources across organizations.

Affected product is Red Hat Satellite 6. All installations that include the Candlepin component are potentially impacted, with no specific patch version ranges listed.

A CVSS score of 8.1 classifies this flaw as high severity, and the absence of an EPSS score doesn’t preclude a high probability of exploitation given the potential for cross‑organization data exposure. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed large‑scale exploitation yet. Attackers must know specific resource identifiers—consumer UUIDs, entitlement IDs, pool IDs, or certificate serials—which are not normally visible across organizations, so the likely attack vector is internal or via privileged API access. The risk to affected environments remains significant, especially where the Candlepin REST API is exposed to administrators who might abuse credentials or where principals can obtain client certificates without stringent checks.