-
Bug
-
Resolution: Done
-
Normal
-
6.15.0, 6.16.0, 6.17.0
-
5
-
False
-
Moderate
-
sat-endeavour
-
None
-
None
-
None
-
Automated
Description of problem:
A user with no assigned roles is able to access the https://satellite.example.com/hosts/register page. This is a security concern as it allows unauthorized users to access a registration interface, which should be restricted.
How reproducible:
100%
Is this issue a regression from an earlier version:
NA
Steps to Reproduce:
1. Create a user account with no assigned roles in Satellite.
2. Log in with this user and navigate to https://satellite.example.com/hosts/register.
3. Observe that the page is accessible instead of displaying a "No Permission" error.
Actual behavior:
Users without roles can still access the /hosts/register page.
Expected behavior:
As the user does not have any privileges, so Permission denied should be visible for all the pages for satellite.
Business Impact / Additional info:
Security threat.