CVE-2026-86323
Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.
| CWE | CWE-639 |
| Vendor | red hat |
| Product | red hat satellite 6.16 for rhel 8 |
| Published | Nov 12, 2026 |
| Last Updated | Nov 13, 2026 |
Get instant alerts for red hat red hat satellite 6.16 for rhel 8
Be the first to know when new medium vulnerabilities affecting red hat red hat satellite 6.16 for rhel 8 are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N