CVE-2026-92904 Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

A flaw was found in the foremanremoteexecution plugin's template invocations controller. The showtemplateinvocationbyhost action resolves the job invocation by ID without evaluating the caller's viewjobinvocations permission filter against the record. An authenticated user whose job invocation...

CVE-2026-92904: Incorrect Authorization

A flaw was found in the foremanremoteexecution plugin's template invocations controller. The showtemplateinvocationbyhost action resolves the job invocation by ID without evaluating the caller's viewjobinvocations permission filter against the record. An authenticated user whose job invocation...

PT-2026-94248

A flaw was found in the foreman remote execution plugin's template invocations controller. The show template invocation by host action resolves the job invocation by ID without evaluating the caller's view job invocations permission filter against the record. An authenticated user whose job...