Summary: A cross-tenant information disclosure flaw was found in Foreman. The taxonomy_scope controller method does not validate organization and location IDs from nested request parameters against the current user's taxonomy memberships, bypassing the existing set_taxonomy authorization check. This flaw allows an authenticated user with host-edit permissions to leak infrastructure metadata such as subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs from organizations and locations they do not belong to.

Requirements to exploit: Authenticated Foreman account with create_hosts or edit_hosts permission (or equivalent hostgroup permissions) in at least one organization. Attacker crafts a single HTTP request with a valid own-org ID at the top level and a foreign org ID in nested params.