CVE-2025-9572
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
- Affected products
- Foreman, Red Hat Satellite 6.15 For Rhel 8, Red Hat Satellite 6.16 For Rhel 8, Red Hat Satellite 6.16 For Rhel 9, Red Hat Satellite 6.17 For Rhel 9, Red Hat Satellite 6.18 For Rhel 9, Enterprise Linux, Ruby-Foreman
- Theforeman Foreman
- < 3.16.2
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.3% (28th percentile)
- Weakness
- CWE-863
- NVD status
- Modified
- Published
- 2026-02-27
Workaround
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-9572 at NVD
No indexed exploits for CVE-2025-9572 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-9572 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.