CVE-2026-106471

Summary

Candlepin's authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. This allows low-privilege authenticated attackers to bypass authorization checks and access unauthorized consumer information or modify entitlements across organizations.

Exploitability

Exploitation requires a low-privilege authenticated user who can access the first referenced object, making it moderately difficult to exploit but not requiring complex attack chains.

Blast radius

The flaw could enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and subscription resources across organizations, potentially affecting multiple tenants in a shared Candlepin deployment.

Detection

Monitor for unusual access patterns where low-privilege users access consumer information or entitlement resources that they should not have access to, particularly when the first accessed resource is a valid target for their permissions.

Prioritized remediation

Upgrade to Candlepin 2.590 or later to address this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.