Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-96659

Foreman: excessive permissions for viewer role on preview

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Satellite 6.16 for RHEL 8

Default version status: affected

  • 0:3.12.0.23-1.el8sat to < *unaffected

Red Hat Red Hat Satellite 6.16 for RHEL 9

Default version status: affected

  • 0:3.12.0.23-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:3.14.0.22-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:3.2.13-1.el9pc to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:3.1.62-1.el9pc to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:5.3.1-2.el9pc to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:0.6.0-1.el9pc to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:15.0.2-2.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:3.14.0-2.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:4.16.0.20-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:1.5.0-2.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:6.17.12-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.17 for RHEL 9

Default version status: affected

  • 0:0.1.0-2.1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.18 for RHEL 9

Default version status: affected

  • 0:3.16.0.25-1.el9sat to < *unaffected

Red Hat Red Hat Satellite 6.19 for RHEL 9

Default version status: affected

  • 0:3.18.0.14-1.el9sat to < *unaffected

References