CVE-2026-106471 - Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
CVE ID :CVE-2026-106471 Published : Oct. 7, 2026, 2:16 a.m. | 1 hour, 11 minutes ago Description :A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every...