CVE-2016-4451

5.0 mediumEPSS 0.9%

Medium (5.0) in theforeman foreman. EPSS 0.9% chance of exploitation in the next 30 days.

The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

Severity

CVSS 3.0

5.0 medium

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-254
Published: 2016-08-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

theforeman:foreman

References

http://projects.theforeman.org/issues/15182
http://projects.theforeman.org/projects/foreman/repository/revisions/1144040f444b4bf4aae81940a150b26b23b4623c
https://access.redhat.com/errata/RHSA-2018:0336
https://theforeman.org/security.html#2016-4451
http://projects.theforeman.org/issues/15182

Check your stack JSON