Description

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-27T13:18:42.463Z",
  "pubdate": "2026-08-27T13:18:42.463Z",
  "executiveSummary": "A Broken Access Control vulnerability exists within the Katello Content View Filter Rules API. This flaw arises from an improper enforcement of organizational authorization boundaries when processing requests for filter rule modifications. An authenticated, low-privileged user possessing baseline Content View permissions in a single organization can manipulate or retrieve data belonging to Content View Filters in entirely separate, unauthorized organizations.\nThe vulnerability allows for the unauthorized disclosure of sensitive configuration metadata and the illicit modification of unpublished Content View filter rules. Because the API fails to validate that the requested filter's parent container belongs to the authenticated user's authorized organizational scope, the integrity and confidentiality of the Content View management process are compromised. The risk is significant for multi-tenant environments where strict organizational isolation is required for repository management. Successful exploitation requires the attacker to possess valid authentication credentials and knowledge of target filter identifiers, facilitating unauthorized cross-organization manipulation of infrastructure configuration.",
  "technicalDetails": "The vulnerability is classified as an authorization bypass resulting from an insecure direct object reference (IDOR) pattern within the Katello Content View Filter Rules API. The root cause is the failure of the application to verify that the 'filter_id' or associated parent object identifier provided in the API request belongs to the organization context of the authenticated user. In a multi-tenant Katello instance, users are typically restricted by organizational membership; however, the API endpoints responsible for managing Content View Filter Rules perform authorization checks only on the filter entity itself or omit the scope validation against the parent Content View's organization attribute.\nExploitation proceeds through the following attack flow: An authenticated attacker identifies a valid identifier for a Content View Filter residing in an organization other than their own. By crafting a specifically formatted HTTP request to the Content View Filter Rules API—typically using GET, PUT, or DELETE methods—the attacker submits the foreign identifier. Because the backend controller fails to enforce an organizational constraint check (e.g., checking 'current_organization_id' against the target resource's 'organization_id'), the application server processes the request as valid. The underlying database query executes against the target resource despite the user's lack of authorization to the destination organization.\nThe impact includes the exposure of filter-rule definitions, which may contain sensitive patterns or exclusion logic relevant to repository management, and the unauthorized alteration of unpublished Content View configurations. Attackers could potentially inject malicious rules, delete existing security filters, or disrupt the lifecycle management workflow by modifying the content view filters of other organizations. This vulnerability persists until the API controller logic is modified to mandate a scope check against the session's current organization context for every request involving a Content View Filter Rule object. The absence of this validation check signifies a critical failure in the application's authorization framework."
}