CVE-2026-106471

Name of the Vulnerable Software and Affected Versions Candlepin (affected versions not specified)

Description A flaw in the central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, rather than requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. If target resource identifiers are known, this can lead to the unauthorized disclosure of consumer information and the unauthorized modification of entitlements and related subscription resources, potentially across different organizations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.