Bug 2547470 (CVE-2026-107203)

Summary:	CVE-2026-107203 foreman: domain and subnet interface API skips host search filters
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anthomas, ehelms, ggainey, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, rchan, security-response-team, smallamp, tmalecek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-07 14:36:48 UTC

The domain and subnet interface API does not apply the caller's host search filter. Nic::Base has no authorized scope. Api::BaseController#parent_scope then keeps only the domain or subnet. The host-nested route does apply the host filter.

The caller must be logged in. They need view_hosts limited by a search, and view_domains or view_subnets on a domain or subnet that also has other hosts. An update also needs edit_hosts. Create and delete look the parent up with edit_domains or edit_subnets.

Reading another host's interface, and changing its IPv4 address, were demonstrated on Foreman 5.0.0-develop. The host API still hid that host. The subnet case used an IPv4 subnet. Creating or deleting an interface, writing a BMC password, and access across organizations were not demonstrated. The interface response includes a BMC username and omits the password.

Introduced in Foreman 1.7.0 by commit 453dc6939 on 2014-10-14, when the domain and subnet nested interface routes were added. The host-nested route was fixed in 1.12.1 and 1.11.4. This path remains, including on develop at cfc5346d6 (2026-10-07).