CVE-2025-9572

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9572.json",
    "cna_assigner": "redhat"
}

References

Affected packages

Git / github.com/theforeman/foreman

Affected ranges

Type

GIT

Repo

https://github.com/theforeman/foreman

Events

Introduced

ddf2ebcf5cfec786e1b176aa24b4811c79c691d5

Fixed

838babaf38b9c872752ec857d1f5d8131133e682

Database specific

{
    "cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.22.0"
        },
        {
            "fixed": "3.16.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Type

GIT

Repo

https://github.com/theforeman/foreman-installer

Events

Introduced

08b36f8f18c964e23e2d83c2e2a2eab710a5d5bc

Fixed

b91317167599c266aa2c204bb94a39f812b7b87b

Database specific

{
    "cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.22.0"
        },
        {
            "fixed": "3.16.2"
        }
    ],
    "source": "CPE_RANGE"
}

Type

GIT

Repo

https://github.com/theforeman/smart-proxy

Events

Introduced

2d3a2f3619aad2f721605285606461ed9f7c0c65

Fixed

54214d71d7eea79c9e991c7d5b8f75aa2156e4e8

Database specific

{
    "cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.22.0"
        },
        {
            "fixed": "3.16.2"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9572.json"