CVE-2026-12515

RubyGems/katello CVE-2026-12515: medium 4.3

katello: missing repository authorization in content_uploads exposes cross-product content existence

Action: Upgrade katello to 4.21.0.rc1 or later.

bundle update katello

Affected

Fixed versions

Sources

• osv: GHSA-c43c-rf7g-5xpg
• https://nvd.nist.gov/vuln/detail/CVE-2026-12515
• https://github.com/Katello/katello/pull/11712
• https://access.redhat.com/errata/RHSA-2026:50221
• https://access.redhat.com/errata/RHSA-2026:50222
• https://access.redhat.com/errata/RHSA-2026:50223
• https://access.redhat.com/errata/RHSA-2026:50263
• https://access.redhat.com/security/cve/CVE-2026-12515
• https://bugzilla.redhat.com/show_bug.cgi?id=2489812
• https://github.com/Katello/katello
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/katello/CVE-2026-12515.yml

CVE-2026-12515 · published 2026-06-17T18:35:57Z · modified 2026-08-05T00:45:57.347825721Z · JSON