Incorrect Authorization Flaw in Foreman Package Network Interface Handling
CVE-2026-107203

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Satellite 6
Vendor
CVE Published:
12 October 2026

What is CVE-2026-107203?

An incorrect authorization flaw exists within the network interface handling in the Foreman package. The domain and subnet interface API inadequately checks that the caller possesses sufficient permissions, as it only verifies that the caller holds host permissions without applying search limits. This oversight allows low-privileged network attackers or users, who may access some hosts and shared domains, to request interface data from these domains or subnets. Consequently, they receive information about interfaces linked to hosts they should not see. If these users also have permissions to edit certain hosts, they are capable of submitting changes to interfaces, which could be saved with unauthorized modifications.

References

https://access.redhat.com/security/cve/CVE-2026-107203
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2547470
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Wenhao Wu (Southeast University) for reporting this issue.
.