CVE-2026-81668Medium· 5.4▾ SunlitA flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117574Critical· 9.1Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
CVE-2024-1313Medium· 6.5grafana: vulnerable to authorization bypass (CVE-2024-1313)
CVE-2026-12515Medium· 4.3katello: missing repository authorization in content_uploads exposes cross-product content existence
CVE-2026-117548Medium· 6.5389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service
CVE-2026-117627Medium· 5.4Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
CVE-2026-117688Medium· 5.3Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration