CVE-2026-86323: Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller
Red Hat · Red Hat Satellite 6.16 for RHEL 8
Vendor fix available · Affected: Red Hat Satellite 6.16 for RHEL 8 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
DescriptionNVD
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 13 Nov.
- Red Hat fixes critical sandbox bypass in SatelliteSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.