CVE-2026-86323Medium· 4.3▾ SunlitA flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target accou…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
0.4% → 0.4%
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.
foreman (all versions)foreman (all versions)foreman (all versions)foreman (all versions)foreman (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86322High· 8.8Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller
CVE-2026-86324Medium· 4.3Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller
CVE-2026-107193Medium· 6.5A flaw has been found in **permission filters** in the **foreman** package
CVE-2026-107443High· 7.7Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)
CVE-2026-111456High· 7.1Candlepin: consumer certificate can register systems in another organization
CVE-2026-107360Critical· 9.6Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions