Bug 2452970 (CVE-2026-5136)

Summary: A privilege escalation flaw was found in Foreman. The Usergroup model does not validate role assignments against the calling user's permissions, unlike the User model which enforces escalation checks. This flaw allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and add themselves as a member, resulting in full privilege escalation to administrator-level access.

Requirements to exploit: Authenticated Foreman account with create_usergroups or edit_usergroups permission (e.g., Site manager, Organization admin, Manager roles, or any custom role including these permissions). Attacker crafts a single API request to create or update a user group with a privileged role_id and their own user_id.