cve.bz

CVE-2026-86323

Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller

4.3 medium

Medium (4.3) in red hat red hat satellite 6.

On this page
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
CWE-639 Authorization Bypass Through User-Controlled Key
OWASP Top 10
A01:2025 Broken Access Control
Published
Modified
Assigned by
redhat (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-86323 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-86323?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-86323?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-86323 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-86323

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-86323](https://cve.bz/cve/badge/CVE-2026-86323.svg)](https://cve.bz/cve/CVE-2026-86323)

HTML:

<a href="https://cve.bz/cve/CVE-2026-86323"><img src="https://cve.bz/cve/badge/CVE-2026-86323.svg" alt="CVE-2026-86323"></a>

Affected

  • red hat:red hat satellite 6

References

Check your stackJSON