Foreman contains an authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController. The controller resolves the target account directly with User.find(params[:user_id]) without enforcing the parent-user authorization that normally restricts access to the target user. As a result, a user who has the create_personal_access_tokens permission can create a Personal Access Token for another user whose account is accessible by ID within the user's taxonomy scope.

The vulnerable endpoint is POST /api/v2/users/:user_id/personal_access_tokens. During token creation, the controller builds the Personal Access Token from the attacker-supplied user_id and returns the plaintext token value in the API response. 

The PersonalAccessToken#check_permissions_after_save model validation does not prevent this cross-user operation: when the token belongs to another user, it verifies the create_personal_access_tokens permission on the token itself but does not require edit_users authorization on the target user.

An attacker with the required create_personal_access_tokens permission can therefore forge a valid PAT belonging to another user and subsequently authenticate as that user using the generated token. This can result in complete account takeover, including takeover of administrator accounts that are visible within the attacker's taxonomy scope.