CVE-2026-86322
Awaiting Analysis Awaiting Analysis - Queue

Foreman Personal Access Token Creation Authorization Bypass

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: redhat-SADP

Description
A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-86322
EUVD
EUVD-2026-124675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Satellite 6 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in Foreman software. It allows a user with the create_personal_access_tokens permission to create a Personal Access Token (PAT) for another user by exploiting a missing authorization check. The attacker can target any user within their scope by directly accessing the user ID via the POST /api/v2/users/:user_id/personal_access_tokens endpoint. The system returns the plaintext token, which the attacker can then use to impersonate the victim, potentially leading to complete account takeover including administrator accounts.

Detection Guidance

Check Foreman API logs for suspicious POST requests to /api/v2/users/:user_id/personal_access_tokens with unusual user IDs. Monitor for unexpected token creation events in the application logs. Use network traffic analysis to detect unauthorized token transmission.

Impact Analysis

If you are a user of Foreman with the create_personal_access_tokens permission, an attacker could create a PAT for your account and gain full access to your account. This includes any permissions or data associated with your account. If you are an administrator, the attacker could take over your account and potentially gain control over the entire Foreman instance, leading to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If an attacker gains access to administrator accounts, they could exfiltrate or manipulate sensitive personal or health information, resulting in non-compliance with data protection regulations. Organizations using Foreman must address this flaw to maintain compliance.

Mitigation Strategies

Apply Foreman updates with the fix immediately. Restrict create_personal_access_tokens permission to authorized users only. Review and revoke any suspicious personal access tokens created recently. Implement additional authorization checks for user token creation endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...