EUVD-2026-124676

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mailnotifications endpoint resolves the target account using User.findparams:id without verifying that the...