CVE-2026-18375
Description
The check_api_acls() function in Pagure's API returns immediately without performing any ACL validation when the requesting user has an active browser session. API endpoints protected by @api_login_required, including the project creation endpoint (POST /api/0/new) and a range of repository management endpoints, rely on this function for access control. As a result, any authenticated Fedora Account holder can invoke these privileged endpoints from a browser context, bypassing group membership requirements — specifically the packager group check enforced in REQUIRED_GROUPS — that would otherwise restrict access. This allows unauthorized creation of repositories under restricted namespaces such as rpms/, which Koji's SCM policy treats as trusted source locations.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
OpenSUSE admins have been informed and a patch has been provided for this vulnerability. The patch would update Pagure to enforce the REQUIRED_GROUPS check within new_project() and to ensure ACL validation is not bypassed for browser sessions. The admin permission requirement added to all *openh264 and epel*-openh264 tags also serves as a compensating control in the chain, preventing any repository created via this bypass from feeding into the signing pipeline.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Acknowledgements
Red Hat would like to thank splitline (@_splitline_) (DEVCORE Research Team) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
