Stanislav Fot

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** A broken access control issue allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is performed by modifying the `match` field through nested host attributes, which bypasses authorization checks. This can lead to the unauthorized modification of managed host configurations across different location and organizational boundaries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) satellite-capsule:el8/foreman (affected versions not specified) **Description** The Usergroup model fails to properly validate role assignments against the permissions of the calling user. This improper authorization occurs within the usergroup management component, where broken permission checks allow an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative ones, to a user group and subsequently add themselves as a member. This leads to full privilege escalation, granting administrator-level access and potentially enabling a complete takeover of managed infrastructure and sensitive data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** An authenticated user with host-edit permissions can exploit a cross-tenant information disclosure flaw. The issue exists because the `taxonomy scope` controller method fails to properly validate organization and location IDs within nested request parameters, which bypasses authorization checks. This allows an attacker to leak sensitive infrastructure metadata from unauthorized organizations and locations, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** foreman (affected versions not specified) **Description** Authenticated users with 'view keypairs' permission can bypass taxonomy scoping, which is a mechanism used to restrict access to resources based on organizational boundaries. This allows them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs, leading to cross-tenant data exposure in multi-tenant deployments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.