Bug 2524899 (CVE-2026-81658)

Summary: CVE-2026-81658 foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, rchan, smallamp, tmalecek
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-27 09:58:05 UTC 
The reported issue is a valid object-level authorization bypass in Foreman's template revision handling.

TemplatesController#revision (app/controllers/templates_controller.rb) loads the requested audit with Audit.find(params[:version]). The corresponding API controllers use Audit.authorized(:view_audit_logs).find(params[:version]). The UI action is a collection endpoint and is not subject to find_resource, so authorization checks only whether the user may invoke the action (for example view_ptables). It does not authorize the specific audit object supplied by the user.

An authenticated, low-privileged user with a template permission such as view_ptables, scoped to one organization or location, can therefore retrieve a historical template revision from another organization or location by supplying its audit identifier. This is possible without view_audit_logs and without access to the template through the normal template API. The same revision action is inherited by partition table, provisioning template, report template, and remote execution job template controllers.

The exposed data is the historical template content, which may include sensitive configuration, credentials, or other secrets depending on customer configuration. This unrestricted lookup has been present since the introduction of STI templates.