CVE-2026-5135
published 2026-07-01CVE-2026-5135: A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.24%
15.2th percentile
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | >= 6.16 < 6.16.10 | 6.16.10 |
| redhat | satellite | >= 6.17 < 6.17.9 | 6.17.9 |
| redhat | satellite | >= 6.18 < 6.18.7 | 6.18.7 |
| redhat | satellite | >= 6.19 < 6.19.2 | 6.19.2 |
| satellite-capsule_el8 | foreman | — | — |
| theforeman | foreman | < 3.18.2 | 3.18.2 |
| theforeman | foreman | >= 3.19.0 < 3.19.1 | 3.19.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in Foreman.
ghsa_unreviewed·2026-07-01
CVE-2026-5135 [MEDIUM] CWE-639 A flaw was found in Foreman.
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Red Hat
foreman: Foreman: Unauthorized modification of host configurations via broken access control
vendor_redhat·2026-04-15·CVSS 6.5
CVE-2026-5135 [MEDIUM] CWE-639 foreman: Foreman: Unauthorized modification of host configurations via broken access control
foreman: Foreman: Unauthorized modification of host configurations via broken access control
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Package: satellite-capsule:el8/foreman (Red Hat Satellite 6) - Affected
No detection rules found.
No public exploits indexed.
2026-07-01
Published