foreman: privilege escalation through Organization and Locations API

It was found that Satellite 6 did not properly enforce access controls on certain resources. An attacker, with access to the API and knowledge of the ID name, can potentially access other resources in other organizations...

CVE-2016-4475: Undefined Security Weakness

The 1 Organization and 2 Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and a read, b edit, or c delete arbitrary organizations or locations via unspecified vectors...

CVE-2016-4451: Undefined Security Weakness

The 1 Organization and 2 Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that...