The vulnerability is located in the Foreman Usergroup model where role assignments are not validated against the caller's permissions. This is a CWE-266 Improper Authorization flaw. An authenticated user who has usergroup management rights can attach arbitrary roles, including administrative ones, to any user group. By then adding themselves as a member to that group, the attacker obtains full administrator privileges. This flaw provides complete control over the system, allowing modification of configuration, data, and potentially compromising other services.

Red Hat Satellite 6 is affected by this flaw. The CVE specifically references the Satellite 6 product, though no particular sub‑version is listed. All installations running that version of the Satellite product should be assessed for the presence of an authenticated user with usergroup management permissions.

The CVSS score for this issue is 8.8, indicating a high severity. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Successful exploitation requires only an authenticated session with usergroup management rights, which can be obtained through legitimate user accounts or compromised credentials. The lack of proper permission checks means the attack can be carried out by an internal user or by any user who can obtain these rights, potentially with minimal effort once the account is compromised.