CVE-2026-86324

A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find user using User.find(params[:user id]) without enforcing the required parent-user authorization check. An attacker with the create ssh keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user id/ssh keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.