---
id: CVE-2026-86324
title: >-
  Foreman: authorization flaw in the foreman::controller::useraware handling
  used by api::v2::sshkeyscontroller
summary: >-
  A flaw was found in Foreman’s Api::V2::SshKeysController, where the target
  user is resolved through Foreman::Controller::UserAware#find_user using
  User.find(params[:user_id]) without enforcing the required parent-user
  authorization check…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Red Hat
product: foreman
affected:
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-13T15:28:45.651295Z'
published: '2026-11-12'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T16:59:10.191Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86324'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:100120'
    label: 'RHSA-2026:100120'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99949'
    label: 'RHSA-2026:99949'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99950'
    label: 'RHSA-2026:99950'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99952'
    label: 'RHSA-2026:99952'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-86324'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2529291'
    label: RHBZ#2529291
tags:
  - cve.org
epss: 0.00313
epssPercentile: 0.24617
ingestedAt: '2026-11-12T20:54:37.312Z'
---

## Overview

A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.

## Affected

- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.