Project

General

Profile

Actions
Copy link

Bug #38913

closed

CVE-2025-9572: GraphQL API permission bypass leads to information disclosure

Added by Ondřej Gajdušek 15 days ago. Updated 11 days ago.

Status:
Closed
Priority:
Immediate
Assignee:
Ondřej Gajdušek
Category:
Security
Target version:
3.18.0
Difficulty:
Triaged:
No
Bugzilla link:
Pull request:
https://github.com/theforeman/foreman/pull/10779, https://github.com/theforeman/foreman/pull/10778, https://github.com/theforeman/foreman/pull/10780
Fixed in Releases:
3.16.2, 3.17.0, 3.18.0
Found in Releases:
Red Hat JIRA:
SAT-38811

Description

Expected Behavior

GraphQL should apply the same taxonomy scoping and permission filters as the REST API.

Impact

Information Disclosure: Authenticated users can view location and organizational structure data beyond their authorized scope.

Technical Details

The GraphQL resolver implementation does not apply taxonomy scoping filters. The fix requires:
  • Apply taxonomy scoping to GraphQL resolver queries
  • Filter taxonomy associations in API responses
  • Ensure GraphQL uses the same authorization logic as REST API

CVE: CVE-2025-9572
Severity: High

Actions
Copy link
 #1

Updated by The Foreman Bot 15 days ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/10774 added
Actions
Copy link
 #2

Updated by The Foreman Bot 15 days ago

  • Pull request https://github.com/theforeman/foreman/pull/10775 added
Actions
Copy link
 #3

Updated by The Foreman Bot 15 days ago

  • Pull request https://github.com/theforeman/foreman/pull/10776 added
Actions
Copy link
 #4

Updated by The Foreman Bot 15 days ago

  • Pull request https://github.com/theforeman/foreman/pull/10778 added
Actions
Copy link
 #5

Updated by The Foreman Bot 15 days ago

  • Fixed in Releases 3.18.0 added
Actions
Copy link
 #6

Updated by Adam Ruzicka 15 days ago

  • Status changed from Ready For Testing to Closed
Actions
Copy link
 #7

Updated by The Foreman Bot 15 days ago

  • Pull request deleted (https://github.com/theforeman/foreman/pull/10774, https://github.com/theforeman/foreman/pull/10775, https://github.com/theforeman/foreman/pull/10776, https://github.com/theforeman/foreman/pull/10778)
Actions
Copy link
 #8

Updated by Oleh Fedorenko 15 days ago

  • Pull request https://github.com/theforeman/foreman/pull/10778 added
Actions
Copy link
 #9

Updated by The Foreman Bot 15 days ago

  • Pull request https://github.com/theforeman/foreman/pull/10779 added
Actions
Copy link
 #10

Updated by The Foreman Bot 15 days ago

  • Pull request https://github.com/theforeman/foreman/pull/10780 added
Actions
Copy link
 #11

Updated by The Foreman Bot 12 days ago

  • Fixed in Releases 3.17.0 added
Actions
Copy link
 #12

Updated by The Foreman Bot 11 days ago

  • Fixed in Releases 3.16.2 added
Actions
Copy link

Also available in: Atom PDF