---
id: CVE-2026-86322
title: >-
  Foreman: authorization flaw in the foreman::controller::useraware#find_user
  handling used by api::v2::personalaccesstokenscontroller
summary: >-
  A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where
  Foreman::Controller::UserAware#find_user resolves the target account using
  User.find(params[:user_id]) without applying the required parent-user
  authorization c…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
vendor: Red Hat
product: foreman
affected:
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-13T19:24:04.760721Z'
published: '2026-11-12'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T19:25:03.846Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86322'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:100120'
    label: 'RHSA-2026:100120'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99949'
    label: 'RHSA-2026:99949'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99950'
    label: 'RHSA-2026:99950'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99952'
    label: 'RHSA-2026:99952'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-86322'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2529289'
    label: RHBZ#2529289
tags:
  - cve.org
epss: 0.00427
epssPercentile: 0.37467
ingestedAt: '2026-11-12T20:54:37.314Z'
---

## Overview

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.

## Affected

- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.