---
id: "CVE-2026-111456"
page: "https://infrastack.ai/live/CVE-2026-111456"
kind: "vulnerability"
aliases: ["CVE-2026-111456"]
title: "Candlepin: missing authorization lets a consumer register in other organizations"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "candlepin", "fixed": [], "affected": ">= 0.4.7 (no fixed version published)", "ecosystem": "vendor"}, {"name": "Red Hat Satellite", "fixed": [], "affected": "6.16, 6.17 (Candlepin 4.4.25), 6.18 (4.6.6), 6.19 (4.7.5)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["candlepin", "multi-organization", "package", "satellite", "self-hosted"]
not_affected_if: ["no-candlepin", "simple-content-access", "single-organization"]
published_at: "2026-11-12T20:18:16+00:00"
first_seen_at: "2026-11-12T20:40:23+00:00"
updated_at: "2026-11-12T20:44:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111456", "first_seen_at": "2026-11-12T20:40:23+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-111456", "first_seen_at": "2026-11-12T20:44:52+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-111456"]}]
exploit_sources: []
---

# Candlepin: missing authorization lets a consumer register in other organizations

Link for people: https://infrastack.ai/live/CVE-2026-111456 (this .md is for agents)

A consumer registration check in Candlepin's ConsumerResource.setupOwner() runs only for user callers, so a consumer authenticated by its identity certificate skips it. An attacker with a valid consumer certificate for one organization can register a new consumer in another organization, read that organization's subscription pools, and attach its entitlements when simple content access is off.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:candlepin affected >= 0.4.7 (no fixed version published) fixed no fixed version listed
- vendor:Red Hat Satellite affected 6.16, 6.17 (Candlepin 4.4.25), 6.18 (4.6.6), 6.19 (4.7.5) fixed no fixed version listed

## How to check

On the Satellite/Candlepin server run 'rpm -q candlepin' (or check your Satellite version). Satellite 6.16-6.19 are all affected (Candlepin 4.4.25, 4.6.6, 4.7.5). Exposed only if the deployment has more than one organization; organizations on simple content access do not allow entitlement attach but pools can still be read.

## Fix

No fixed version published yet by Red Hat (page says apply security updates when available). Watch Bugzilla 2553939 and the Red Hat CVE page.

## Timeline

- 2026-11-12T20:40:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111456
- 2026-11-12T20:44:52+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-111456 — Red Hat CVE page read: Important, no fix yet, no config mitigation; Candlepin >=0.4.7 contains the flaw, all Satellite versions affected (6.16/6.17 Candlepin 4.4.25, 6.18 4.6.6, 6.19 4.7.5). Upstream fixed version not found.

## Documents

- [advisory] CVE-2026-111456 - Red Hat Customer Portal https://access.redhat.com/security/cve/CVE-2026-111456

## From the sources

A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_