19 matches found
CVE-2026-92893
A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...
CVE-2026-92893 Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters
A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...
CVE-2026-92893 Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters
A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...
CVE-2026-92893
CVE-2026-92893 affects the foreman_ansible Ruby gem (a Foreman plugin). The Ansible inventory API controller builds its host query using an unscoped Host.where call that fails to enforce the search filter tied to the caller's view_hosts permission. As a result, an authenticated user whose host vi...
EUVD-2026-81418
A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...
CVE-2026-92894
A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...
CVE-2026-92894 Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction
A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...
CVE-2026-92894
A flaw in the foreman_ansible plugin 's Ansible override values API allows an authenticated user with the edit_ansible_variables permission to delete any LookupValue record by ID. The destroy action resolves the target without verifying it belongs to an AnsibleVariable the caller is authorized to...
EUVD-2026-81417
A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...
CVE-2026-92894 Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction
A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...
CVE-2026-92894
A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...
CVE-2026-92893
A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...
CVE-2026-92893: Incorrect Authorization
A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...
CVE-2026-92894: Incorrect Authorization
A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...
Improper Authorization
Overview foremanansible is an Ansible integration with Foreman. Affected versions of this package are vulnerable to Improper Authorization. A authenticated attacker with certain permissions to create and run Ansible jobs is able to access hosts through job templates. The highest threat from this...
CVE-2020-10716
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects...
Design/Logic Flaw
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects...
CVE-2020-10716
CVE-2020-10716 describes a UI access-control flaw in Red Hat Satellite’s Job Invocation: the "User Input" entry is not properly restricted to the view, allowing a user with access to Job Invocation to scan the invocation and search for passwords or other sensitive data. Affected: tfm-rubygem-fore...
CVE-2020-10716: Improper Authorization
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects...