---
id: CVE-2026-86323
title: >-
  Foreman: authorization flaw in the mail-notification endpoints implemented by
  api::v2::mailnotificationscontroller
summary: >-
  A flaw was found in Foreman’s Api::V2::MailNotificationsController, where
  authorization checks on user-specific mail-notification resources are
  insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves
  the target accou…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Red Hat
product: foreman
affected:
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-13T15:39:28.245266Z'
published: '2026-11-12'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T16:59:05.475Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86323'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:100120'
    label: 'RHSA-2026:100120'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99949'
    label: 'RHSA-2026:99949'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99950'
    label: 'RHSA-2026:99950'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99952'
    label: 'RHSA-2026:99952'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-86323'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2529290'
    label: RHBZ#2529290
tags:
  - cve.org
epss: 0.00389
epssPercentile: 0.33547
ingestedAt: '2026-11-12T20:54:37.311Z'
---

## Overview

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.

## Affected

- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.