Foreman contains an authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController. The controller resolves the target user directly from the request parameter without verifying that the authenticated user is authorized to access or modify that user's mail-notification configuration.

For the read operation, GET /api/v2/users/:id/mail_notifications assigns @user = User.find(params[:id]) without an ownership or parent-user authorization check. Because the view_mail_notifications permission is included in the default Viewer role, a user with Viewer privileges can retrieve another user's mail-notification subscriptions, including configured mail_query search strings. This results in cross-user disclosure of notification configuration and potentially sensitive information about the resources or activity being monitored by the victim.
The same controller also fails to correctly enforce authorization for mail-notification creation and modification through POST and PUT /api/v2/users/:user_id/mail_notifications. The validate_params method invokes deny_access when the requester is neither the target user nor an administrator, but does not halt execution after denying access. Consequently, the controller action continues and may persist the unauthorized notification configuration despite returning a 403 response or subsequently triggering a DoubleRenderError (HTTP 500).

An attacker can therefore use the affected API to read another user's mail-notification configuration and, with the required permissions for the write path, modify or create mail-notification records for that user. The underlying issue is improper authorization of the target user combined with failure to terminate request processing after an authorization denial.