CVE-2026-107445

A moderate-impact cross-organization authorization bypass was found in Katello, the content management component of Red Hat Satellite. The Flatpak Remote Repositories API resolves records by identifier using an unscoped lookup in a before_action used by the show and mirror actions, rather than the properly scoped readable lookup used by the index action. As a result, an authenticated user who holds the view_flatpak_remotes permission in one organization can access flatpak remote repository information belonging to another organization. The same unscoped lookup backs the mirror action, which may allow such a user to create a repository in a product they can edit that is configured with another organization's flatpak remote registry URL and stored remote credentials (username/token). The issue is rated Moderate with a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), consistent with the upstream rating; it requires an authenticated, low-privileged user and has limited confidentiality and integrity impact with no impact to availability. Red Hat Satellite 6.16, 6.17, 6.18, and 6.19 are affected, but the fix is currently deferred because the flaw is rated Moderate with a CVSS score below 7.0; the residual risk is that an authenticated user could read or mirror another organization's flatpak remote repository data and use its stored remote credentials. Red Hat Hardened Images is not affected because the vulnerable Katello component is not present in that product.