---
id: "CVE-2026-86322"
page: "https://infrastack.ai/live/CVE-2026-86322"
kind: "vulnerability"
aliases: ["CVE-2026-86322"]
title: "Foreman: low-privilege users can mint access tokens for other accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Red Hat Satellite 6", "fixed": [], "affected": "version range not published", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api", "foreman", "infrastructure", "red-hat-satellite", "self-hosted"]
not_affected_if: ["no-create-personal-access-tokens-role", "no-token-permission-users"]
published_at: "2026-11-12T21:17:33+00:00"
first_seen_at: "2026-11-12T21:40:31+00:00"
updated_at: "2026-11-12T21:44:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86322", "first_seen_at": "2026-11-12T21:40:31+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-86322", "first_seen_at": "2026-11-12T21:44:11+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-86322", "https://www.theforeman.org/security.html"]}]
exploit_sources: []
---

# Foreman: low-privilege users can mint access tokens for other accounts

Link for people: https://infrastack.ai/live/CVE-2026-86322 (this .md is for agents)

Foreman's personal access token API (POST /api/v2/users/:user_id/personal_access_tokens) does not check that the caller may manage the target user. A user with the create_personal_access_tokens permission can create a token for another account, including an administrator, and receives the plaintext token. They can then authenticate as that user. Red Hat rates it CVSS 8.8 and lists Satellite 6 as affected. No affected Foreman versions or fixed release are published yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Red Hat Satellite 6 affected version range not published fixed no fixed version listed

## How to check

Check whether any non-admin user or role has the create_personal_access_tokens permission (Administer > Roles). Affected Foreman versions are not published yet, so any Foreman or Red Hat Satellite 6 instance with such roles should be treated as exposed until a fixed release is announced. Review existing personal access tokens on privileged users for ones you did not create.

## Timeline

- 2026-11-12T21:40:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86322
- 2026-11-12T21:44:11+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-86322 — Red Hat CNA page + CVE record read: flaw in Api::V2::PersonalAccessTokensController (find_user lacks authorization on target user); CVSS 8.8, CWE-639. No affected/fixed Foreman versions published yet; Foreman security page does not list it and the Red Hat page has no fix. Nothing verified. Not a code-checkable condition without versions.

## Documents

- [advisory] Red Hat CVE-2026-86322 (CNA) https://access.redhat.com/security/cve/CVE-2026-86322
- [mentions] Foreman security advisories (CVE-2026-86322 not listed as of 2026-11-12) https://www.theforeman.org/security.html

## From the sources

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_