Answer in brief
CVE-2026-12515 records a Medium severity (CVSS 4.3) vulnerability in Katello: missing repository authorization in content_uploads exposes cross-product content existence. The current sources do not mark it as known exploited. The current feed maps katello (rubygems), katello (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps katello (rubygems), katello (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| katellorubygems | <4.21.0.rc1 | 4.21.0.rc1 |
| katellorubygems | >=0 <4.21.0.rc1 | 4.21.0.rc1 |
Published upstream
Jun 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.
Quoted source text, attributed separately from HOL analysis.