{"id":"CVE-2026-86322","title":"Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller","summary":"A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization c…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-639"],"vendor":"Red Hat","product":"foreman","affected":["foreman (all versions)","foreman (all versions)","foreman (all versions)","foreman (all versions)","foreman (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-13T19:24:04.760721Z"},"published":"2026-11-12","updated":"2026-11-13","sourceUpdated":"2026-11-13T19:25:03.846Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-86322","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:100120","label":"RHSA-2026:100120"},{"url":"https://access.redhat.com/errata/RHSA-2026:99949","label":"RHSA-2026:99949"},{"url":"https://access.redhat.com/errata/RHSA-2026:99950","label":"RHSA-2026:99950"},{"url":"https://access.redhat.com/errata/RHSA-2026:99952","label":"RHSA-2026:99952"},{"url":"https://access.redhat.com/security/cve/CVE-2026-86322"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529289","label":"RHBZ#2529289"}],"tags":["cve.org"],"epss":0.00427,"epssPercentile":0.37467,"ingestedAt":"2026-11-12T20:54:37.314Z","slug":"CVE-2026-86322","body":"## Overview\n\nA flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.\n\n## Affected\n\n- `foreman (all versions)`\n- `foreman (all versions)`\n- `foreman (all versions)`\n- `foreman (all versions)`\n- `foreman (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}