CVE-2026-86322

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find user resolves the target account using User.find(params[:user id]) without applying the required parent-user authorization check. An attacker with the create personal access tokens permission can therefore invoke POST /api/v2/users/:user id/personal access tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check permissions after save only validates create personal access tokens on the token and does not enforce edit users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.