CVE-2026-86324Medium· 4.3▾ SunlitA flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
0.3% → 0.3%
A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.
foreman (all versions)foreman (all versions)foreman (all versions)foreman (all versions)foreman (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86322High· 8.8Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller
CVE-2026-86323Medium· 4.3Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller
CVE-2026-107193Medium· 6.5A flaw has been found in **permission filters** in the **foreman** package
CVE-2026-107443High· 7.7Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)
CVE-2026-111456High· 7.1Candlepin: consumer certificate can register systems in another organization
CVE-2026-107360Critical· 9.6Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions