CVE-2025-9572 — Foreman: satellite: graphql api permission bypass leads to information disclosure
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces acc…
Published: 2026-02-27 · CVSS: 5.0 · CVSS 3.1
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7