HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-106471 — A flaw was found in Candlepin. The central authorization filter incorrectly gran...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this c

Analysis

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations. CVSS Score: 8.1. Published: 2026-10-07T02:16:57.583.

Indicators of Compromise (1)

CVE (1)
CVE-2026-106471
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

FSB finalises responsible AI adoption guidance

The Financial Stability Board (FSB) today published its final report on Sound Practices for Responsible Adoption of Artificial Intelligence, reflecting public feedback received on a consultative version of the report, published in June 2026.

Finextra
MEDIUMVulnerabilityNEW

New Zealand regulators set out cyber and AI risk expectations

The Reserve Bank of New Zealand – Te Pūtea Matua (RBNZ) and the Financial Markets Authority – Te Mana Tātai Hokohoko (FMA) have today outlined their supervisory expectations on cyber risks associated with frontier Artificial Intelligence (AI).

Finextra
MEDIUMVulnerabilityNEW

Sound Credit Union signs for Temenos Collections

Temenos (SIX: TEMN), a global leader in banking technology, today announced that Sound Credit Union (Sound), one of Washington State’s largest credit unions, has selected Temenos Collections delivered as Temenos SaaS to modernize its collections operations.

Finextra