CVE-2026-56098

Name of the Vulnerable Software and Affected Versions rubygem-katello (affected versions not specified)

Description An authorization bypass exists in the RegistryProxiesController within Katello due to an execution fall-through in the registry authorize filter. Although the application detects unauthorized requests and triggers an error response via the unauthorized() function, it fails to halt the execution of the current code path because of a missing return statement. This control flow failure allows the application to continue into business logic and database validation filters, revealing internal state through differential responses. An unprivileged attacker can exploit this to enumerate valid Users, Organizations, and Products across the instance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.