Bug #39478: CVE-2026-5136: Privilege escalation via usergroup role assignment manipulation - Foreman

Actions

Copy link

Bug #39478

closed

CVE-2026-5136: Privilege escalation via usergroup role assignment manipulation

Added by Ondřej Gajdušek about 1 month ago. Updated about 1 month ago.

Status:

Closed

Priority:

Immediate

Assignee:

Category:

Security

Target version:

Difficulty:

Triaged:

Bugzilla link:

Pull request:

https://github.com/theforeman/foreman/pull/11064, https://github.com/theforeman/foreman/pull/11065, https://github.com/theforeman/foreman/pull/11066

Fixed in Releases:

3.18.2, 3.19.1, 5.0.0

Found in Releases:

Red Hat JIRA:

SAT-43815

Description

A privilege escalation vulnerability was found in Foreman's usergroup management. The Usergroup model does not validate whether the calling user is permitted to assign the specified roles, unlike the User model which enforces ensure_roles_not_escalated. A user with create_usergroups or edit_usergroups permission can attach arbitrary roles (including "System admin") to a usergroup via the API, add themselves as a member, and inherit those elevated privileges.

CVSS: 8.8 (Important)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-266

Credit: Stanislav Fot (Aisle Research)