An information disclosure vulnerability was found in Foreman's taxonomy_scope controller method. The method loads organization and location IDs from nested request parameters via find_by_id without checking the user's taxonomy membership, overriding the validated context set by set_taxonomy. An authenticated user with host-edit permissions can supply a foreign organization ID in nested parameters to scope AJAX queries to a tenant they do not belong to, leaking infrastructure metadata such as domains, subnets, and IP availability across organization boundaries.

CVSS: 4.3 (Moderate)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-639

Credit: Stanislav Fot (Aisle Research)