{"id":"CVE-2026-111456","kind":"vulnerability","aliases":["CVE-2026-111456"],"related":[],"title":"Candlepin: missing authorization lets a consumer register in other organizations","description":"A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer.","summary":"A consumer registration check in Candlepin's ConsumerResource.setupOwner() runs only for user callers, so a consumer authenticated by its identity certificate skips it. An attacker with a valid consumer certificate for one organization can register a new consumer in another organization, read that organization's subscription pools, and attach its entitlements when simple content access is off.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"candlepin","fixed":[],"affected":">= 0.4.7 (no fixed version published)","ecosystem":"vendor"},{"name":"Red Hat Satellite","fixed":[],"affected":"6.16, 6.17 (Candlepin 4.4.25), 6.18 (4.6.6), 6.19 (4.7.5)","ecosystem":"vendor"}],"ecosystems":[],"tags":["candlepin","multi-organization","package","satellite","self-hosted"],"not_affected_if":["no-candlepin","simple-content-access","single-organization"],"how_to_check":"On the Satellite/Candlepin server run 'rpm -q candlepin' (or check your Satellite version). Satellite 6.16-6.19 are all affected (Candlepin 4.4.25, 4.6.6, 4.7.5). Exposed only if the deployment has more than one organization; organizations on simple content access do not allow entitlement attach but pools can still be read.","fix":"No fixed version published yet by Red Hat (page says apply security updates when available). Watch Bugzilla 2553939 and the Red Hat CVE page.","status":"open","published_at":"2026-11-12T20:18:16+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","triaged_at":"2026-11-12T20:42:13+00:00","updated_at":"2026-11-12T20:44:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T20:42:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Candlepin: missing authorization lets a consumer register in other organizations","impact":"medium","summary":"A consumer registration check in Candlepin's ConsumerResource.setupOwner() runs only for user callers, so a consumer authenticated by its identity certificate skips it. An attacker with a valid consumer certificate for one organization can register a new consumer in another organization, read that organization's subscription pools, and attach its entitlements when simple content access is off.","audience":"businesses","category":"package","nicknames":[],"who_cares":["candlepin","self-hosted","satellite"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads another organization's pools and attaches its entitlements","analyst_note":"Sources list no product ranges or fixed version; find the Candlepin release that adds the permission check in setupOwner() and the affected version range in the NVD or upstream advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-candlepin","simple-content-access"],"who_is_affected":"Organizations running Candlepin, the subscription management service behind Red Hat Satellite-style deployments, where consumers hold identity certificates. Exposure requires a valid consumer certificate from another organization and a target organization that does not use simple content access. Deployments that do not run Candlepin, or that use simple content access everywhere, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4659,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources list no product ranges or fixed version; find the Candlepin release that adds the permission check in setupOwner() and the affected version range in the NVD or upstream advisory.","search":"'-111456':13A,16A '-2026':12A,15A 'access':84B,196C 'anoth':69B 'attach':78B,200C 'attack':54B,138C,179C,198C 'authent':46B,122C 'author':3A,87C 'caller':42B,115C 'candlepin':1A,17A,21B,35B,101C 'certif':50B,59B,126C,146C,170C,177C 'check':33B,88C,106C,132C 'consum':6A,31B,45B,58B,67B,96C,111C,120C,145C,154C,174C,208C 'consumerresource.setupowner':37B,93C 'content':83B,195C 'creat':109C 'cve':11A,14A 'differ':157C 'entitl':80B,204C 'found':91C 'function':94C 'go':129C 'hat':19A 'host':29B 'ident':49B,125C,169C 'includ':167C 'key':164C 'let':4A 'low':135C 'low-privileg':134C 'method':105C 'miss':2A,86C 'modul':98C 'multi':23B 'multi-organ':22B 'network':137C 'new':66B,153C,173C,207C 'one':61B,148C 'organ':10A,24B,62B,70B,73B,149C,158C,162C,184C,190C,202C 'packag':25B,102C 'permiss':107C 'pool':76B,187C 'privileg':136C 'read':71B 'red':18A 'regist':7A,64B,151C 'registr':32B,97C,104C 'respons':166C 'run':38B 'satellit':26B 'satellite':20A 'self':28B 'self-host':27B 'simpl':82B,194C 'skip':51B 'subscript':75B,186C 'suppli':160C 'target':183C 'use':193C 'user':41B,118C,140C 'valid':57B,144C 'view':181C","nicknames":[],"mitigations":[],"who_affected":"Teams running Candlepin, including every Red Hat Satellite 6.16 to 6.19, with more than one organization. An attacker needs a valid consumer identity certificate from one organization and the key of another; registered systems hold such certificates by default. Single-organization deployments are not exposed to the cross-organization step. Red Hat notes restricting network access to the Candlepin port only limits who can attempt the call.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:44:52Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-111456","run_id":3780},"products":{"at":"2026-11-12T20:44:52Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-111456","run_id":3780},"who_affected":{"at":"2026-11-12T20:44:52Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-111456","run_id":3780}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["candlepin","hatsatellite","redhatsatellite"],"ptokens":["candlepin","hat","red","satellite"],"labels":["candlepin","high","multiorganization","package","satellite","selfhosted"],"campaign_type":null,"search_a":"'-111456':13A,16A '-2026':12A,15A 'author':3A 'candlepin':1A,17A 'consum':6A 'cve':11A,14A 'hat':19A 'let':4A 'miss':2A 'organ':10A 'red':18A 'regist':7A 'satellite':20A","search_b":"'access':84B 'anoth':69B 'attach':78B 'attack':54B 'authent':46B 'caller':42B 'candlepin':21B,35B 'certif':50B,59B 'check':33B 'consum':31B,45B,58B,67B 'consumerresource.setupowner':37B 'content':83B 'entitl':80B 'host':29B 'ident':49B 'multi':23B 'multi-organ':22B 'new':66B 'one':61B 'organ':24B,62B,70B,73B 'packag':25B 'pool':76B 'read':71B 'regist':64B 'registr':32B 'run':38B 'satellit':26B 'self':28B 'self-host':27B 'simpl':82B 'skip':51B 'subscript':75B 'user':41B 'valid':57B","search_c":"'access':196C 'attach':200C 'attack':138C,179C,198C 'authent':122C 'author':87C 'caller':115C 'candlepin':101C 'certif':126C,146C,170C,177C 'check':88C,106C,132C 'consum':96C,111C,120C,145C,154C,174C,208C 'consumerresource.setupowner':93C 'content':195C 'creat':109C 'differ':157C 'entitl':204C 'found':91C 'function':94C 'go':129C 'ident':125C,169C 'includ':167C 'key':164C 'low':135C 'low-privileg':134C 'method':105C 'miss':86C 'modul':98C 'network':137C 'new':153C,173C,207C 'one':148C 'organ':149C,158C,162C,184C,190C,202C 'packag':102C 'permiss':107C 'pool':187C 'privileg':136C 'regist':151C 'registr':97C,104C 'respons':166C 'simpl':194C 'subscript':186C 'suppli':160C 'target':183C 'use':193C 'user':118C,140C 'valid':144C 'view':181C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111456","severity":null,"published_at":"2026-11-12T20:18:16+00:00","modified_at":"2026-11-12T20:18:16+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","fetched_at":"2026-11-12T20:40:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111456:3780","url":"https://access.redhat.com/security/cve/CVE-2026-111456","severity":null,"published_at":"2026-11-12T20:44:52+00:00","modified_at":"2026-11-12T20:44:52+00:00","first_seen_at":"2026-11-12T20:44:52+00:00","fetched_at":"2026-11-12T20:44:52+00:00","note":"Red Hat CVE page read: Important, no fix yet, no config mitigation; Candlepin >=0.4.7 contains the flaw, all Satellite versions affected (6.16/6.17 Candlepin 4.4.25, 6.18 4.6.6, 6.19 4.7.5). Upstream fixed version not found.","cites":["https://access.redhat.com/security/cve/CVE-2026-111456"]}],"documents":[{"id":138442,"url":"https://access.redhat.com/security/cve/CVE-2026-111456","title":"CVE-2026-111456 - Red Hat Customer Portal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}