Executive brief
Foreman is an infrastructure management platform used to configure and audit system templates across multiple organizations. The vulnerability allows a low-privileged authenticated user to bypass organizational boundaries and view sensitive historical template contents—including credentials and secrets—from other organizations or locations by exploiting incomplete authorization checks in the template revision endpoint.
Technical details
The vulnerability is an authorization bypass (CWE-639) in Foreman's template revision endpoint. The web UI's revision retrieval logic does not enforce object-level authorization checks when accessing audited template revisions, allowing an authenticated user with limited template permissions (e.g., view_ptables) to retrieve historical template contents from other organizations or locations by specifying an audit ID. An attacker supplies the audit ID of a template revision outside their authorized scope and receives the full historical template body, which may contain credentials, configuration secrets, or other sensitive information. The REST API revision endpoints are not affected as they already enforce authorization-aware scoping. Authentication is required and the attacker must possess a valid account with a template-related permission, but no special conditions or user interaction are necessary.
Affected products
- Red Hat Foreman
Timeline
- 2026-08-27: disclosed
- 2026-08-27: other: Published by Red Hat Security