Foreman contains an authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController. The controller resolves the target user through User.find(params[:user_id]) without enforcing the required parent-user authorization. Consequently, a user with the create_ssh_keys permission can create an SSH key associated with another user accessible within the attacker's taxonomy scope.

The vulnerable endpoint is POST /api/v2/users/:user_id /ssh_keys. Because the target user is not validated against the caller's authorization scope before the SSH key is created, an attacker can supply another user's ID and inject their own public SSH key into that account.

The injected key is subsequently used by Foreman when provisioning hosts associated with the victim user through the sshkey provisioning snippet. This can cause the attacker's public key to be installed for the victim's managed systems, allowing the attacker to authenticate to those hosts with the corresponding private key.

Successful exploitation therefore allows a lower-privileged user with create_ssh_keys permission to modify another user's SSH configuration and potentially obtain SSH access to systems managed or provisioned by that user. The vulnerability results from missing authorization of the parent user before creating the child SSH-key resource.