CVE-2026-86322

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

PT-2026-146048

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefind user resolves the target account using User.findparams:user id without applying the required parent-user authorization check. An attacker with the create personal access tokens permissi...