Authorization Flaw in Foreman Affects User Notification Settings
CVE-2026-86323

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Satellite 6
Vendor
CVE Published:
12 November 2026

What is CVE-2026-86323?

A vulnerability exists in Foreman's Api::V2::MailNotificationsController due to insufficient authorization checks on user-specific mail notification resources. The GET endpoint allows access to another user's mail-notification configuration without proper verification of the authenticated user's authorization, potentially exposing sensitive notification settings. Furthermore, the POST and PUT endpoints do not terminate execution upon unauthorized access attempts, allowing unauthorized modifications to persist despite receiving a 403 response. This exposes users to significant risks, including unauthorized disclosure of mail-query values and alterations to notification settings.

References

https://access.redhat.com/security/cve/CVE-2026-86323
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2529290
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Sandipan Roy (Red Hat) and Tej Rathi (Red Hat).
.