Katello, a component of Red Hat Satellite, contains an authorization flaw in the ContentUploadsController. Users granted the edit_products permission can query repository content for repositories outside the products they manage, revealing whether specific content exists. This exposes sensitive inventory information but does not allow modification, import, or publication of content, limiting the impact to information disclosure.

The vulnerability appears in Red Hat Satellite 6 and Red Hat Hardened Images deployments that use Katello. No specific version numbers are listed, so all installations that include the affected component are potentially impacted.

The CVSS score of 4.3 classifies this issue as low severity, and the EPSS score of less than 1% indicates a very small probability of exploitation. It is not listed in the CISA KEV repository. The likely attack scenario requires an authenticated user with edit_products rights, so the threat applies only to users who already possess that permission. While exploitation is possible, the narrow target set and low risk platform make the overall risk modest.