Description

A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T06:16:58.463Z",
  "pubdate": "2026-10-12T06:16:58.463Z",
  "executiveSummary": "A broken access control vulnerability exists within the foreman package, specifically concerning the handling of permission filters within the API.\nThe vulnerability allows an authenticated low-privileged user or network attacker, who possesses the requisite permissions to delete filters for a single role, to bypass existing authorization constraints.\nBy manipulating the identifier of a filter during a deletion request, an attacker can delete filters associated with arbitrary roles, including those they should not have administrative access to.\nThe primary impact of this vulnerability is the unauthorized removal of access control rules for other roles, resulting in an immediate loss of functional access for users or services assigned to those roles.\nThis flaw stems from the application failing to validate the scope of the caller's permissions against the target object's association with a specific role during the filter deletion process.\nSuccessful exploitation requires that the attacker already maintains the capability to delete filters for at least one authorized role, after which they can leverage the lack of server-side validation to target arbitrary, unlocked roles across the system.",
  "technicalDetails": "The vulnerability is situated within the API's filter management logic of the foreman package. The root cause is an improper authorization check during the deletion process of permission filters.\nWhen an API request is initiated to delete a filter, the application retrieves the target filter based on its identifier. However, the system fails to verify that the requesting user's authorization scope encompasses the role associated with the target filter. Instead, the application erroneously applies the logic globally without validating the caller's specific permission context relative to the target resource.\nThe attack flow proceeds as follows: First, an authenticated attacker with 'delete' permission for a single, specific role identifies the API endpoint responsible for filter deletion. Second, the attacker crafts a request targeting the identifier of a filter belonging to a different, unauthorized role. Third, because the application fails to perform a cross-check between the authenticated user's permissions and the role bound to the requested filter ID, it processes the deletion command as if the request were legitimate.\nAs a result of the missing validation, the system executes the deletion of the filter from the database. This directly affects the authorization structure of the target roles, causing an immediate denial of service regarding the specific permissions formerly granted by the deleted filter.\nThe vulnerability is limited to 'unlocked' roles, meaning system-defined or immutable roles may remain protected depending on the application's internal locking mechanisms. However, for any role that is modifiable, the attacker can systematically dismantle the access rights of other users or service accounts, leading to privilege degradation or complete access loss for affected roles.\nThere is no indication that this flaw allows for privilege escalation to an administrator role; rather, it functions as a denial-of-service vector against the authorization model itself by stripping legitimate permissions from targeted roles."
}