CVE-2026-56098 Red Hat — Exploit & Vulnerability Details MEDIUM

Parameter	Value
CVSS	4.3 (MEDIUM)
Type	CWE-203
Vendor	Red Hat
Public PoC	No

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement).

This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

Low

Partial data leak

Integrity

None

No data modification

Availability

None

No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-203

Vulnerable Products

red hat:red hat satellite 6.18 for rhel 9 red hat:red hat satellite 6.16 for rhel 8 red hat:red hat satellite 6.19 for rhel 9 red hat:red hat satellite 6.16 for rhel 9 red hat:red hat satellite 6