Project

General

Profile

Actions
Copy link

Bug #38913

closed

CVE-2025-9572: GraphQL API permission bypass leads to information disclosure

Added by Ondřej Gajdušek about 2 months ago. Updated about 2 months ago.

Status:
Closed
Priority:
Immediate
Assignee:
Ondřej Gajdušek
Category:
Security
Target version:
3.18.0
Difficulty:
Triaged:
No
Bugzilla link:
Pull request:
https://github.com/theforeman/foreman/pull/10779, https://github.com/theforeman/foreman/pull/10778, https://github.com/theforeman/foreman/pull/10780
Fixed in Releases:
3.16.2, 3.17.0, 3.18.0
Found in Releases:
Red Hat JIRA:
SAT-38811

Description

Expected Behavior

GraphQL should apply the same taxonomy scoping and permission filters as the REST API.

Impact

Information Disclosure: Authenticated users can view location and organizational structure data beyond their authorized scope.

Technical Details

The GraphQL resolver implementation does not apply taxonomy scoping filters. The fix requires:
  • Apply taxonomy scoping to GraphQL resolver queries
  • Filter taxonomy associations in API responses
  • Ensure GraphQL uses the same authorization logic as REST API

CVE: CVE-2025-9572
Severity: High

Actions
Copy link

Also available in: Atom PDF