CVE catalog

CVE-2025-9572

UBUNTU-

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Severity: Medium · CVSS 5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: Aug 29, 2025, 6:12:00 AM UTC
Updated: May 20, 2026, 4:24:04 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.38% · Oct 27, 2026

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed: Oct 27, 2026, 5:59:01 PM UTC

References

[https://osv.dev/vulnerability/UBUNTU-CVE-2025-9572]
[https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9572.json]

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]