Description

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-26T06:16:30.110Z",
  "pubdate": "2026-08-26T06:16:30.110Z",
  "executiveSummary": "A broken access control vulnerability exists in the Katello Content View History API, specifically characterized as an Insecure Direct Object Reference (IDOR) flaw.\nThis vulnerability allows an authenticated attacker to bypass organizational boundaries and access restricted lifecycle metadata belonging to unauthorized Content Views.\nThe primary impact is the unauthorized disclosure of sensitive lifecycle information, including promotion events, publication history, timestamps, and associated user identities.\nThe vulnerability affects the Katello product and requires an attacker to possess valid authentication within the platform, albeit with permissions potentially limited to a separate organization.\nThe risk implication is a significant breach of multi-tenant isolation, as attackers can enumerate and inspect lifecycle workflows of other organizations, which could potentially aid in further reconnaissance or targeted attacks against infrastructure management processes.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization checks within the Content View History API endpoint. The application fails to validate whether the requester possesses the appropriate organizational context or ownership permissions for the specific Content View ID supplied in the request.\nThe vulnerability manifests as an Insecure Direct Object Reference (IDOR). In a typical attack flow, the attacker performs the following steps: First, the attacker identifies a valid Content View ID belonging to a different organization, which may be discovered through enumeration or side-channel information. Second, the attacker interacts with the Content View History API endpoint, providing the target identifier within the API request parameters.\nBecause the backend service neglects to cross-reference the requested Content View's organization ID against the active user's session privileges, the server proceeds to process the request. The application performs a lookup based solely on the provided identifier and returns the associated history objects.\nThe affected component is the API layer responsible for retrieving lifecycle history. This includes the logic that mediates access to publication and promotion event logs. Successful exploitation grants the attacker read-only access to the internal audit trails of Content Views managed by other tenants.\nExploitation requirements include a valid authenticated session within the Katello instance. While the attacker must be authorized to view some Content Views within their own assigned organization, the lack of scope validation allows the bypass of multi-tenancy constraints. No specialized administrative privileges are required to target objects outside the attacker's authorized scope.\nPost-exploitation impact includes the systematic exposure of sensitive operational metadata. This allows attackers to map the release cycles, software promotion patterns, and the activity of administrative users across the entire Katello deployment. This information disclosure can significantly weaken the overall security posture by revealing internal infrastructure maintenance windows and identifying the specific versions of packages being promoted across different organizational environments."
}