FOREMAN · CVE-2026-86323 · Package
NO FIX YET
Foreman's mail notification API checks authorization incompletely, so an authenticated user can read another user's mail notification configuration, including mail_query values. Where write permissions apply, the same flaw lets that user create or modify notification settings for someone else because the request continues after a denial.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Foreman, typically for provisioning and managing hosts, where user accounts exist on the Foreman instance. Exposure needs an account on that instance that can reach the v2 users API; instances without shared user accounts have a smaller exposed surface. The sources do not name the affected Foreman versions.
Not affected if no-untrusted-users
Who cares foreman, ruby, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.