Privilege escalation via incomplete file-operation authorization

Improper authorization in Red Hat CloudForms Management Engine before 5.11.10.1 allows remote authenticated users to access administrator file operations. The role check for administrative file import and export accepts membership in a specific nonadministrator group instead of restricting those operations to system administrators. An existing account in that group is required, and exploitation exposes or alters administrative data without a reported availability impact.