{"id":"PYSEC-2026-1808","summary":"Pulp incorrectly assigns RBAC permissions in tasks that create objects","details":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","aliases":["CVE-2024-7143","GHSA-9m5j-4xx9-44j9"],"modified":"2026-07-16T18:00:07.748043852Z","published":"2026-07-07T14:34:38.535044Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7143"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2024:6765"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2024-7143"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2300125"},{"type":"PACKAGE","url":"https://github.com/pulp/pulpcore"},{"type":"WEB","url":"https://github.com/pulp/pulpcore/blob/93f241f34c503da0fbac94bdba739feda2636e12/pulpcore/tasking/_util.py#L108"},{"type":"WEB","url":"https://github.com/pulp/pulpcore/blob/main/CHANGES.md"},{"type":"PACKAGE","url":"https://pypi.org/project/pulpcore"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9m5j-4xx9-44j9"}],"affected":[{"package":{"name":"pulpcore","ecosystem":"PyPI","purl":"pkg:pypi/pulpcore"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.56.0"}]}],"versions":["3.0.0","3.0.0b1","3.0.0b10","3.0.0b11","3.0.0b12","3.0.0b13","3.0.0b14","3.0.0b15","3.0.0b16","3.0.0b17","3.0.0b18","3.0.0b19","3.0.0b2","3.0.0b20","3.0.0b21","3.0.0b22","3.0.0b23","3.0.0b3","3.0.0b4","3.0.0b5","3.0.0b6","3.0.0b7","3.0.0b8","3.0.0b9","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.0rc4","3.0.0rc5","3.0.0rc6","3.0.0rc7","3.0.0rc8","3.0.0rc9","3.0.1","3.1.0","3.1.1","3.10.0","3.11.0","3.11.0.post0","3.11.1","3.11.2","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.14.1","3.14.10","3.14.11","3.14.12","3.14.13","3.14.14","3.14.15","3.14.16","3.14.17","3.14.18","3.14.19","3.14.2","3.14.3","3.14.4","3.14.5","3.14.6","3.14.7","3.14.8","3.14.9","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.15.9","3.16.0","3.16.1","3.16.10","3.16.11","3.16.12","3.16.13","3.16.14","3.16.15","3.16.16","3.16.17","3.16.18","3.16.19","3.16.2","3.16.20","3.16.21","3.16.22","3.16.23","3.16.24","3.16.3","3.16.4","3.16.5","3.16.6","3.16.7","3.16.8","3.16.9","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.1","3.18.10","3.18.11","3.18.12","3.18.13","3.18.14","3.18.15","3.18.16","3.18.17","3.18.18","3.18.19","3.18.2","3.18.20","3.18.21","3.18.22","3.18.23","3.18.24","3.18.25","3.18.26","3.18.27","3.18.28","3.18.29","3.18.3","3.18.30","3.18.31","3.18.32","3.18.33","3.18.34","3.18.35","3.18.4","3.18.5","3.18.6","3.18.7","3.18.8","3.18.9","3.19.0","3.19.1","3.2.0","3.2.1","3.20.0","3.21.0","3.21.1","3.21.10","3.21.11","3.21.12","3.21.13","3.21.14","3.21.15","3.21.16","3.21.17","3.21.18","3.21.19","3.21.2","3.21.20","3.21.21","3.21.22","3.21.23","3.21.24","3.21.25","3.21.26","3.21.29","3.21.3","3.21.30","3.21.31","3.21.32","3.21.33","3.21.34","3.21.35","3.21.36","3.21.4","3.21.5","3.21.6","3.21.7","3.21.8","3.21.9","3.22.0","3.22.1","3.22.10","3.22.11","3.22.12","3.22.13","3.22.14","3.22.15","3.22.16","3.22.17","3.22.18","3.22.19","3.22.2","3.22.20","3.22.21","3.22.22","3.22.24","3.22.25","3.22.26","3.22.27","3.22.28","3.22.29","3.22.3","3.22.30","3.22.31","3.22.32","3.22.33","3.22.34","3.22.35","3.22.4","3.22.5","3.22.6","3.22.7","3.22.8","3.22.9","3.23.0","3.23.1","3.23.10","3.23.11","3.23.12","3.23.13","3.23.14","3.23.15","3.23.16","3.23.17","3.23.18","3.23.19","3.23.2","3.23.20","3.23.21","3.23.22","3.23.23","3.23.24","3.23.3","3.23.4","3.23.5","3.23.6","3.23.7","3.23.8","3.23.9","3.24.0","3.24.1","3.25.0","3.25.1","3.26.0","3.26.1","3.26.2","3.27.0","3.27.1","3.27.2","3.28.0","3.28.1","3.28.10","3.28.11","3.28.12","3.28.13","3.28.14","3.28.15","3.28.16","3.28.17","3.28.18","3.28.19","3.28.2","3.28.20","3.28.21","3.28.22","3.28.23","3.28.24","3.28.25","3.28.26","3.28.27","3.28.28","3.28.29","3.28.3","3.28.30","3.28.31","3.28.32","3.28.33","3.28.34","3.28.35","3.28.36","3.28.37","3.28.38","3.28.39","3.28.4","3.28.40","3.28.41","3.28.42","3.28.43","3.28.44","3.28.5","3.28.6","3.28.7","3.28.8","3.28.9","3.29.0","3.29.1","3.29.2","3.29.3","3.29.4","3.29.5","3.29.6","3.29.7","3.29.8","3.3.0","3.3.1","3.30.0","3.31.0","3.32.0","3.32.1","3.33.0","3.34.0","3.35.0","3.36.0","3.37.0","3.38.0","3.38.1","3.39.0","3.39.1","3.39.10","3.39.11","3.39.12","3.39.13","3.39.14","3.39.15","3.39.16","3.39.17","3.39.18","3.39.19","3.39.2","3.39.20","3.39.21","3.39.22","3.39.23","3.39.24","3.39.25","3.39.26","3.39.27","3.39.28","3.39.29","3.39.3","3.39.30","3.39.31","3.39.32","3.39.33","3.39.34","3.39.35","3.39.4","3.39.5","3.39.6","3.39.7","3.39.8","3.39.9","3.4.0","3.4.1","3.40.0","3.40.1","3.40.2","3.40.3","3.40.4","3.41.0","3.41.1","3.42.0","3.43.0","3.43.1","3.43.2","3.43.3","3.44.0","3.44.1","3.45.0","3.45.1","3.45.2","3.45.3","3.45.4","3.46.0","3.47.0","3.48.0","3.49.0","3.49.1","3.49.10","3.49.11","3.49.12","3.49.13","3.49.14","3.49.15","3.49.16","3.49.17","3.49.18","3.49.19","3.49.2","3.49.20","3.49.21","3.49.22","3.49.23","3.49.24","3.49.25","3.49.26","3.49.27","3.49.28","3.49.29","3.49.3","3.49.30","3.49.31","3.49.32","3.49.33","3.49.34","3.49.35","3.49.36","3.49.37","3.49.38","3.49.39","3.49.4","3.49.40","3.49.41","3.49.42","3.49.43","3.49.44","3.49.45","3.49.46","3.49.47","3.49.48","3.49.49","3.49.5","3.49.50","3.49.51","3.49.52","3.49.53","3.49.54","3.49.55","3.49.56","3.49.57","3.49.58","3.49.59","3.49.6","3.49.60","3.49.61","3.49.62","3.49.63","3.49.64","3.49.65","3.49.7","3.49.8","3.49.9","3.5.0","3.50.0","3.50.1","3.50.2","3.50.3","3.51.0","3.51.1","3.51.2","3.51.3","3.52.0","3.53.0","3.53.1","3.54.0","3.54.1","3.55.0","3.55.1","3.55.2","3.55.3","3.56.0","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5.post1","3.6.5.post2","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.5.post0","3.7.6","3.7.7","3.7.8","3.7.9","3.8.0","3.8.1","3.9.0","3.9.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/pulpcore/PYSEC-2026-1808.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}