CVE-2026-86323
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Foreman Mail Notification API

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: redhat-SADP

Description
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-86323
EUVD
EUVD-2026-124676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Satellite 6 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in Foreman's mail-notification endpoints. It allows authenticated users to access or modify another user's mail-notification configuration without proper authorization checks. The GET endpoint for retrieving notifications does not verify ownership, enabling users to view another user's notification subscriptions, including sensitive search strings. The POST and PUT endpoints fail to properly enforce authorization, allowing unauthorized modifications despite returning a 403 error.

Detection Guidance

Check Foreman logs for unauthorized access attempts to /api/v2/users/:id/mail_notifications endpoints. Monitor for 403 errors followed by successful requests or DoubleRenderError messages. Inspect mail_notification configurations for unexpected changes or disclosures.

Impact Analysis

This vulnerability can allow an authenticated user to disclose another user's mail-notification configuration, including mail_query values. If write permissions apply, it may also allow unauthorized modification or creation of notification settings for another user. This could lead to exposure of monitored resources or activities.

Mitigation Strategies

Apply Foreman updates or patches addressing CVE-2026-86323. Temporarily restrict access to mail-notification endpoints via firewall rules. Review user permissions to ensure least privilege. Monitor for suspicious activity in notification configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...