The Ansible inventory API in foreman_ansible builds its host set via Host.where(condition_key => ids) in the show_inventory private method of AnsibleInventoriesController. The before_action :authorize filter only confirms the caller holds a view_hosts permission covering the controller action; it does not apply any filter attached to that permission. The taxonomy default scope on Host::Base limits results to the caller's organizations and locations, so this does not cross org/location boundaries. However, a user whose view_hosts is narrowed by a filter (e.g., hostgroup, lifecycle environment, or name pattern) can supply arbitrary host IDs within their organizations and receive full Ansible inventory including parameters flagged as hidden (real values, not masked) and Ansible variable values with hidden_value? set.

The correctly scoped pattern Host.authorized(:view_hosts) is used elsewhere in the same plugin (ApiCommon#find_host_ansible_role). The built-in "Ansible Tower Inventory Reader" role includes view_hosts, making the endpoint reachable without custom roles. No non-default configuration is required.

Introduced in foreman_ansible 3.0.1 (commit 13a1529, 2019-06-27, PR #265) when the inventory preview feature was first created. All versions from 3.0.1 through at least 18.0.2 are affected.