Vendor
Foreman contains an authorization bypass vulnerability in the PersonalAccessTokensController that allows an attacker to create tokens on behalf of other users, leading to full account takeover.