A high-severity authorization vulnerability in Red Hat Certificate System allows authenticated users to bypass intended policy restrictions, potentially compromising certificate issuance integrity.

This is an incorrect authorization flaw (CWE-863) within the v2 REST ACL filter. An authenticated user can leverage lexicographic string comparison errors to gain unauthorized access to the profile management API, specifically performing actions reserved for Administrator-level accounts.

The ability for a lower-privileged user to manipulate the certificate authority issuance policy poses a significant risk to the organization. Successful exploitation could lead to unauthorized certificate generation or modification, undermining the trust model of the entire PKI infrastructure. With a CVSS score of 8.1, this vulnerability is classified as High severity and demands immediate attention to prevent potential data integrity compromise.

Immediate Action: Review the official Red Hat security advisory for the availability of updated packages and apply all relevant security patches to the pki-core components immediately.

Proactive Monitoring: Monitor API access logs for unusual POST requests to the /v2/profiles/raw endpoint, particularly those originating from user accounts with limited permissions like Certificate Manager Agents.

Compensating Controls: Restrict network access to the Certificate System REST API to only known, trusted management segments and enforce strict role-based access control (RBAC) to minimize the number of accounts with the profiles.approve permission.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the integrity of certificate management operations. Given the potential for privilege escalation within the Certificate System, administrators should prioritize patching as soon as the vendor provides the necessary updates. Until patches are deployed, ensure that administrative access to the REST API is strictly governed and monitored to prevent exploitation by malicious insiders or compromised service accounts.