{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/candlepin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:redhat:candlepin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-106471"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Candlepin"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authentication-bypass","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-106471 exists within the Candlepin authorization framework. The issue stems from the central authorization filter failing to correctly implement logic for '@Verify-annotated' parameters. Instead of enforcing that all required entities associated with a request are verified, the filter grants access if at least one parameter is accessible. This allows a low-privilege authenticated attacker to bypass authorization checks on subsequent objects. By identifying target resource identifiers, an attacker can access sensitive consumer information and potentially modify entitlements and subscription resources across different organizational boundaries. This vulnerability poses a significant risk to the integrity and confidentiality of subscription management data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability enables unauthorized information disclosure and unauthorized modification of subscription resources. Successful exploitation allows low-privileged users to perform actions outside their permitted scope, potentially affecting resources across organizations, which could lead to significant data breaches and administrative misconfiguration of subscription environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize applying the vendor-supplied security patches for Candlepin to resolve the flawed authorization filter logic. Monitor system access logs for anomalous, high-frequency requests targeting sensitive resource identifiers that typically require elevated privileges.\u003c/p\u003e\n","date_modified":"2026-10-07T08:35:46Z","date_published":"2026-10-07T08:35:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-07-candlepin-auth-bypass/","summary":"A flaw in the Candlepin authorization filter allows low-privileged authenticated users to bypass security checks and access unauthorized resources by exploiting flawed parameter verification.","title":"Authorization Bypass Vulnerability in Candlepin","url":"https://feed.craftedsignal.io/briefs/2026-10-07-candlepin-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Candlepin","version":"https://jsonfeed.org/version/1.1"}