{"id":"CVE-2026-86323","kind":"vulnerability","aliases":["CVE-2026-86323"],"related":[],"title":"Foreman: mail notification API lets users read and change other users' settings","description":"A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.","summary":"Foreman's mail notification API checks authorization incompletely, so an authenticated user can read another user's mail notification configuration, including mail_query values. Where write permissions apply, the same flaw lets that user create or modify notification settings for someone else because the request continues after a denial.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foreman","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["foreman","package","ruby","self-hosted"],"not_affected_if":["no-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T21:17:33+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","triaged_at":"2026-11-12T21:42:26+00:00","updated_at":"2026-11-12T21:42:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T21:42:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Foreman: mail notification API lets users read and change other users' settings","impact":"medium","summary":"Foreman's mail notification API checks authorization incompletely, so an authenticated user can read another user's mail notification configuration, including mail_query values. Where write permissions apply, the same flaw lets that user create or modify notification settings for someone else because the request continues after a denial.","audience":"businesses","category":"package","nicknames":[],"who_cares":["foreman","self-hosted","ruby"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads or alters other users' notification settings","analyst_note":"Find the affected and fixed Foreman versions and the default configuration from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-86323) or the Foreman advisory.","how_to_check":"unknown","plain_action":"","product_name":"Foreman","needs_analyst":true,"not_affected_if":["no-untrusted-users"],"who_is_affected":"Teams running Foreman, typically for provisioning and managing hosts, where user accounts exist on the Foreman instance. Exposure needs an account on that instance that can reach the v2 users API; instances without shared user accounts have a smaller exposed surface. The sources do not name the affected Foreman versions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4724,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86323':15A,18A '/api/v2/users':100C,131C '403':160C 'access':120C,137C 'account':106C 'addit':126C 'allow':148C,167C 'anoth':40B,172C,194C 'api':4A,30B,82C 'appli':53B,187C 'authent':36B,115C 'author':32B,86C,118C 'call':135C 'chang':9A,157C 'check':31B,87C 'configur':45B,125C,178C 'continu':71B,152C 'creat':60B,190C 'cve':13A,16A 'deni':136C 'denial':74B 'despit':158C 'disclos':171C 'doublerendererror':164C 'els':67B 'endpoint':102C 'execut':147C 'fail':144C 'flaw':56B,76C 'foreman':1A,19A,20B,26B,80C 'found':78C 'get':99C 'halt':146C 'host':25B 'id':110C 'id/mail_notifications':101C,133C 'includ':46B,179C 'incomplet':33B 'insuffici':97C 'let':5A,57B 'mail':2A,28B,43B,47B,93C,176C,180C 'mail-notif':92C,175C 'mailnotificationscontrol':84C 'modifi':62B,188C 'notif':3A,29B,44B,63B,94C,124C,177C,191C 'packag':21B 'param':109C 'path':134C 'permiss':52B,186C 'persist':154C 'post':128C 'put':130C 'queri':48B,181C 'read':7A,39B 'request':70B,140C,150C 'resolv':103C 'resourc':95C 'respons':161C 'rubi':22B 'self':24B 'self-host':23B 'set':12A,64B,192C 'someon':66B 'specif':91C 'subsequ':163C 'target':105C 'unauthor':142C,156C 'use':107C 'user':6A,11A,37B,41B,59B,90C,116C,122C,132C,169C,173C,195C 'user-specif':89C 'user.find':108C 'v2':83C 'valu':49B,182C 'verifi':112C 'without':111C 'write':51B,185C","nicknames":[],"mitigations":[],"who_affected":"Teams running Foreman, typically for provisioning and managing hosts, where user accounts exist on the Foreman instance. Exposure needs an account on that instance that can reach the v2 users API; instances without shared user accounts have a smaller exposed surface. The sources do not name the affected Foreman versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["foreman"],"ptokens":["foreman"],"labels":["foreman","medium","package","ruby","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-86323':15A,18A 'api':4A 'chang':9A 'cve':13A,16A 'foreman':1A,19A 'let':5A 'mail':2A 'notif':3A 'read':7A 'set':12A 'user':6A,11A","search_b":"'anoth':40B 'api':30B 'appli':53B 'authent':36B 'author':32B 'check':31B 'configur':45B 'continu':71B 'creat':60B 'denial':74B 'els':67B 'flaw':56B 'foreman':20B,26B 'host':25B 'includ':46B 'incomplet':33B 'let':57B 'mail':28B,43B,47B 'modifi':62B 'notif':29B,44B,63B 'packag':21B 'permiss':52B 'queri':48B 'read':39B 'request':70B 'rubi':22B 'self':24B 'self-host':23B 'set':64B 'someon':66B 'user':37B,41B,59B 'valu':49B 'write':51B","search_c":"'/api/v2/users':100C,131C '403':160C 'access':120C,137C 'account':106C 'addit':126C 'allow':148C,167C 'anoth':172C,194C 'api':82C 'appli':187C 'authent':115C 'author':86C,118C 'call':135C 'chang':157C 'check':87C 'configur':125C,178C 'continu':152C 'creat':190C 'deni':136C 'despit':158C 'disclos':171C 'doublerendererror':164C 'endpoint':102C 'execut':147C 'fail':144C 'flaw':76C 'foreman':80C 'found':78C 'get':99C 'halt':146C 'id':110C 'id/mail_notifications':101C,133C 'includ':179C 'insuffici':97C 'mail':93C,176C,180C 'mail-notif':92C,175C 'mailnotificationscontrol':84C 'modifi':188C 'notif':94C,124C,177C,191C 'param':109C 'path':134C 'permiss':186C 'persist':154C 'post':128C 'put':130C 'queri':181C 'request':140C,150C 'resolv':103C 'resourc':95C 'respons':161C 'set':192C 'specif':91C 'subsequ':163C 'target':105C 'unauthor':142C,156C 'use':107C 'user':90C,116C,122C,132C,169C,173C,195C 'user-specif':89C 'user.find':108C 'v2':83C 'valu':182C 'verifi':112C 'without':111C 'write':185C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T21:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86323","severity":null,"published_at":"2026-11-12T21:17:33+00:00","modified_at":"2026-11-12T21:17:33+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","fetched_at":"2026-11-12T21:40:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}