← CVE Intelligence

CVE-2026-96659

Foreman: excessive permissions for viewer role on preview PUBLISHED

Description (CNA)

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Satellite 6.16 for RHEL 8unaffected 0:3.12.0.23-1.el8sat before *
Red Hat / Red Hat Satellite 6.16 for RHEL 9unaffected 0:3.12.0.23-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.14.0.22-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.2.13-1.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.1.62-1.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:5.3.1-2.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:0.6.0-1.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:15.0.2-2.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.14.0-2.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:4.16.0.20-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:1.5.0-2.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:6.17.12-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:0.1.0-2.1.el9sat before *
Red Hat / Red Hat Satellite 6.18 for RHEL 9unaffected 0:3.16.0.25-1.el9sat before *
Red Hat / Red Hat Satellite 6.19 for RHEL 9unaffected 0:3.18.0.14-1.el9sat before *

CWE

CWE-267

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.