Cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atheforemanforeman/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 22:52:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgForeman: Personal Access Token Authorization Bypass (CVE-2026-86322)https://feed.craftedsignal.io/briefs/2026-11-foreman-auth-bypass-cve-2026-86322/Thu, 12 Nov 2026 22:52:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-foreman-auth-bypass-cve-2026-86322/Foreman contains an authorization bypass vulnerability in the PersonalAccessTokensController that allows an attacker to create tokens on behalf of other users, leading to full account takeover.A flaw exists in the Foreman Api::V2::PersonalAccessTokensController where the UserAware#find_user method fails to verify if the requesting user has the authority to act on behalf of the target user defined in the user_id parameter. An attacker with existing 'create_personal_access_tokens' permissions can send a crafted POST request to create a token for any user, including administrators. The application returns the plaintext token, which the attacker can then use for unauthorized authentication.

Impact

Successful exploitation allows an attacker to impersonate any user within the Foreman instance, including administrative accounts, resulting in full unauthorized access to the platform and associated infrastructure managed by Foreman.

Recommendation

  • Identify and audit the use of personal access tokens in the environment.
  • Immediately upgrade all instances of Foreman to the latest version that includes the fix for CVE-2026-86322.
  • Review audit logs for suspicious activity involving the Api::V2::PersonalAccessTokensController endpoint.
]]>highadvisory