It looks like there no validation to prevent users from switching orgs on models like products in the model layer. It looks like this is done in the controller instead.
Created from redmine issue http://projects.theforeman.org/issues/6767
Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.
Upstream bug component is API
Per 6.3 planning, moving out non acked bugs to the backlog
Upstream bug component is API - Content