CVE-2026-92904

4.3 Moyenne

Publiée le 17/09/2026 à 15:17 · Modifiée le 18/09/2026 à 21:06 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.

Traduire en français

Produits concernés

Red Hat Satellite 6

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-863

Références

https://access.redhat.com/security/cve/CVE-2026-92904
https://bugzilla.redhat.com/show_bug.cgi?id=2535942

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories