Description

An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-12T06:16:58.667Z",
  "pubdate": "2026-10-12T06:16:58.667Z",
  "executiveSummary": "A vulnerability exists in the network interface handling logic within the Foreman package, categorized as an Incorrect Authorization flaw. The flaw stems from insufficient permission validation when processing requests via the domain and subnet interface API.\nSpecifically, the application validates that a user possesses host-related permissions but fails to enforce necessary search limits. Consequently, API requests can return interface information for hosts that the requesting user is not authorized to access. This exposure impacts confidentiality by leaking sensitive network interface records associated with other hosts.\nFurthermore, if the attacker possesses edit permissions for even a single host, they can influence the state of interfaces belonging to hosts outside their authorized scope, leading to a violation of data integrity. Exploitation requires the attacker to be an authenticated user with existing host-viewing permissions and access to a shared domain or subnet. The risk is significant for multi-tenant or collaborative environments where proper isolation of infrastructure metadata is required to maintain security boundaries.",
  "technicalDetails": "The vulnerability resides in the Foreman API layer responsible for managing network interfaces associated with domains and subnets. The root cause is an improper authorization check that relies solely on a generic host permission check without applying the mandatory search scope constraints required to isolate resources.\nWhen a user queries the domain or subnet interface API, the backend verifies if the user holds the requisite host permission. However, the implementation omits the application of scope-based filters. As a result, the API controller retrieves and serializes interface records from the entire domain or subnet, rather than restricting the output to the subset of hosts the user is authorized to manage or view.\nThe attack flow proceeds as follows: An authenticated low-privileged user identifies a target domain or subnet that contains both authorized and unauthorized hosts. The attacker issues a crafted API request to retrieve interface configurations for the targeted scope. Because the authorization check is inadequately scoped, the application returns the full set of interface records, including those belonging to hosts the attacker lacks the permission to view.\nThe impact escalates if the attacker possesses legitimate edit permissions for any single host within their scope. Due to the lack of proper association validation, the attacker can submit a write request targeting an interface record obtained from the unauthorized retrieval process. The backend, failing to cross-verify the authorization context for the specific object, proceeds to commit the modification. This allows an unauthorized actor to perform unauthorized administrative changes to network interface configurations, such as modifying IP assignments or network settings for hosts beyond their security boundary.\nThis vulnerability effectively bypasses the Role-Based Access Control (RBAC) mechanisms intended to segregate infrastructure management tasks in Foreman. The failure to enforce resource-level authorization checks allows for both unauthorized information disclosure and potential unauthorized modification of data, facilitating lateral movement or service disruption within the managed infrastructure."
}