Executive brief
Katello is Red Hat's subscription and content management component used to manage repositories and content distribution. A flaw in its Content View Filter Rules API allows a low-privileged user in one organization to view and modify filter configurations belonging to other organizations by directly supplying a filter identifier, potentially exposing filter metadata and allowing unauthorized changes to content filtering rules.
Technical details
The vulnerability is a cross-tenant authorization bypass (CWE-639) in Katello's Content View Filter Rules API. The API loads parent Content View Filters by identifier without performing proper authorization-aware scope checking, allowing authenticated users with Content View permissions in one organization to access and modify filter rules in other organizations. An attacker can read filter-rule metadata and add, change, or delete rules outside their authorized organization; however, changes only affect unpublished filter configurations and cannot modify already-published Content View versions or repository contents. The vulnerability requires network access and low-level privileges within the system but no user interaction.
Affected products
- Red Hat Katello <UNKNOWN>
Timeline
- 2026-08-27: disclosed