CVE-2026-5136

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:34365	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:34366	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:34367	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:34368	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-5136	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2452970	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

Configuration 2 (hide)

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR	cpe:2.3:a:theforeman:foreman::::::::
	cpe:2.3:a:theforeman:foreman::::::::

History

No history.

Information

Published : 2026-07-01 14:16

Updated : 2026-07-09 02:39

NVD link : CVE-2026-5136

Mitre link : CVE-2026-5136

CVE.ORG link : CVE-2026-5136

JSON object : View

Products Affected

redhat

enterprise_linux
satellite

theforeman

foreman

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-5136", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5136", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_maintenance:6.16::el8", "cpe:/a:redhat:satellite_maintenance:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:3.12.0.17-1.el8sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_maintenance:6.16::el8", "cpe:/a:redhat:satellite_maintenance:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:3.12.0.17-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.17::el9", "cpe:/a:redhat:satellite_capsule:6.17::el9", "cpe:/a:redhat:satellite_maintenance:6.17::el9", "cpe:/a:redhat:satellite_utils:6.17::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:3.14.0.17-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.18::el9", "cpe:/a:redhat:satellite_capsule:6.18::el9", "cpe:/a:redhat:satellite_utils:6.18::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:3.16.0.17-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.19::el9", "cpe:/a:redhat:satellite_capsule:6.19::el9", "cpe:/a:redhat:satellite_maintenance:6.19::el9", "cpe:/a:redhat:satellite_utils:6.19::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:3.18.0.7-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "satellite-capsule:el8/foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-07-01T14:16:47.277", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:34365", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:34366", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:34367", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:34368", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-5136", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452970", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access."}], "lastModified": "2026-07-09T02:39:36.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "878EADE5-65A0-45A8-A8A9-E01B59510745", "versionEndExcluding": "6.16.10", "versionStartIncluding": "6.16"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4F23367-8065-4400-9346-2DDAC9718C1F", "versionEndExcluding": "6.17.9", "versionStartIncluding": "6.17"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38DDD3BD-13AA-48BA-8404-B906C2BE3395", "versionEndExcluding": "6.18.7", "versionStartIncluding": "6.18"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8698362F-3FF7-4B48-B799-722E2143DBFD", "versionEndExcluding": "6.19.2", "versionStartIncluding": "6.19"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC9CCF49-E31C-4087-B1E2-45FE2DAE1BFF", "versionEndExcluding": "3.18.2"}, {"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A63B3B6B-B05A-49CC-8694-1D357171773F", "versionEndExcluding": "3.19.1", "versionStartIncluding": "3.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}