Bug 2547437 (CVE-2026-107193)

Summary: CVE-2026-107193 foreman: API filter lookup ignores a search-limited filter permission
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, rchan, security-response-team, smallamp, tmalecek
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-07 13:39:52 UTC 
The API loads a filter by id without the caller's search limit. The lookup is Api::V2::FiltersController#resource_scope, which returns every filter. The action check only asks whether the caller has the delete permission at all. Nothing checks that specific filter on delete. A filter on a locked built-in role is still rejected.

The caller must be logged in and must hold a permission to delete filters that is limited by a search, for example to one role.

Deletion of a filter on another unlocked role was demonstrated through the API. The same delete through the web interface was refused. An update that moves a filter onto a role inside the caller's search was read from the code and was not demonstrated.