Description

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T13:18:42.037Z",
  "pubdate": "2026-08-27T13:18:42.037Z",
  "executiveSummary": "A broken object-level authorization (BOLA) vulnerability exists within the template revision endpoint of the Foreman application. This vulnerability allows an authenticated user with limited template-related permissions (such as view_ptables) to bypass organizational and location-based isolation boundaries. By supplying a specific audit ID, a low-privileged attacker can retrieve historical content for templates to which they should not have access.\nThe flaw stems from the application failing to perform necessary authorization checks on the template revision retrieval logic, unlike the REST API revision endpoints which implement proper validation. The primary impact is the unauthorized disclosure of sensitive configuration data, potentially including credentials or proprietary infrastructure secrets embedded within historical template revisions.\nThis vulnerability is critical for multi-tenant environments where strict separation between organizations or locations is required. Exploitation does not require elevated privileges beyond the basic ability to view templates, making it an accessible path for lateral information gathering by an already authenticated malicious actor. The vulnerability poses a significant risk to the confidentiality of infrastructure management secrets.",
  "technicalDetails": "The vulnerability resides in the audit-related template revision retrieval endpoint in Foreman. While the REST API revision endpoints correctly enforce organizational and location-based scoping, the audited template revision endpoint lacks a functional check to verify if the requested historical record belongs to the user’s assigned organization or location context.\nThe root cause is a deficiency in the authorization middleware or controller-level logic for the audit retrieval mechanism. Specifically, the application logic fails to map the object ID retrieved via the audit log back to the enforced scope of the current user session. Consequently, the backend processes the request based solely on the audit ID parameter without cross-referencing the object's ownership metadata against the session context.\nThe attack flow is straightforward for an authenticated user holding minimal permissions such as 'view_ptables'. The attacker identifies a target audit ID, which may be discovered through internal enumeration or observation of template audit trails. By crafting an HTTP request directed at the vulnerable template revision endpoint and providing the target audit ID as a parameter, the attacker forces the application to return the historical template body.\nBecause the system validates the existence of the audit record but ignores the associated resource boundaries, the template content is returned directly to the client. This exposes configuration files, preseed scripts, or kickstart templates that may contain sensitive variables, API keys, or administrative credentials configured during earlier revisions.\nThis vulnerability represents a significant deviation from secure coding practices regarding object-level authorization. The discrepancy between the secure REST API endpoints and the insecure audited revision endpoint suggests an inconsistent implementation of the security model across the application's interface surface. The vulnerability allows an attacker to bypass logical segmentation controls, enabling them to harvest information across different organizational units within a single Foreman instance.\nPost-exploitation, an attacker can maintain a repository of sensitive information extracted from these revisions, providing them with a persistent advantage for further exploitation of the infrastructure managed by Foreman. This facilitates lateral movement and potentially privilege escalation if the harvested credentials provide access to additional systems or services managed via the template-based orchestration layer."
}