CVE-2026-107193
6.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-639
Impact
An authenticated user with permission to delete filters in one role can delete filters from other unlocked roles across the network. This removes permissions associated with those affected roles, disrupting authorization controls.
Root cause
The Foreman API loads permission filters directly by identifier without validating whether the caller's role permissions allow modifying that specific filter.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade the foreman package to the patched version once released by Red Hat. Until patched, revoke filter deletion permissions from non-administrative roles.
$ rpm -q foremanAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.