CVE-2016-7078

4.3 mediumEPSS 1.4%

Medium (4.3) in theforeman foreman. EPSS 1.4% chance of exploitation in the next 30 days.

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

Severity

CVSS 3.0

4.3 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-285
Published: 2018-09-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

theforeman:foreman

References

http://www.securityfocus.com/bid/96385
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078
https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905
https://projects.theforeman.org/issues/16982
https://seclists.org/oss-sec/2017/q1/470

Check your stack JSON