CVEFinder.io

CVE-2026-81658

🔶 medium
Summary

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration informati

Description

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.

CVSS Score
6.5
Medium
EPSS Score
0.3
Exploit Probability
Published Date
2026-08-27
First Seen: 2026-08-28
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 365,890 vulnerabilities in our database.

#195,497
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 27, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Red Hat would like to thank Arpit Jain, Independent Security Researcher (Github: arpitjain099) for reporting this issue.
SSVC data provided by CISA
Last Modified 2026-10-07
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE IDs (Weakness Types)
CWE-639

📦 Affected Products 2

Vendor Product Status Affected Versions
theforeman foreman Affected
v-
redhat satellite Affected
v6.0

🔗 References 2

https://access.redhat.com/security/cve/CVE-2026-81658
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2524899
Issue Tracking Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-12423 ⚠️ high 7.5 0.4 A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication... 2026-10-01
CVE-2026-12540 ⚠️ high 8.2 1.2 A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The req... 2026-10-01
CVE-2026-12541 ⚠️ high 8.2 1.2 A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump t... 2026-10-01
CVE-2026-12544 ⚠️ high 7.7 0.2 A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a v... 2026-10-01
CVE-2026-5136 ⚠️ high 8.8 0.3 A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the call... 2026-07-01
CVE-2026-5135 🔶 medium 6.5 0.2 A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permis... 2026-07-01
These CVEs affect the same products