CVE-2026-71468CWE-266

CVE-2026-71468

Medium · published August 12, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.5th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-08-12T00:18Z
References (8)
https://access.redhat.com/errata/RHSA-2026:60386 · [email protected]https://access.redhat.com/errata/RHSA-2026:60387 · [email protected]https://access.redhat.com/errata/RHSA-2026:60388 · [email protected]https://access.redhat.com/errata/RHSA-2026:60389 · [email protected]https://access.redhat.com/errata/RHSA-2026:60390 · [email protected]https://access.redhat.com/errata/RHSA-2026:60391 · [email protected]https://access.redhat.com/security/cve/CVE-2026-71468 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2512147 · [email protected]
EPSS history
Timeline
  • 11 AUG 19:24Z
    Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache
    cvelistv5