CVE-2026-86323Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller

Descripción

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• RHSA-2026:100120 vendor-advisory
• RHSA-2026:99949 vendor-advisory
• RHSA-2026:99950 vendor-advisory
• RHSA-2026:99952 vendor-advisory
• https://access.redhat.com/security/cve/CVE-2026-86323 vdb-entry
• RHBZ#2529290 issue-tracking