CVE-2026-81658

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-81658	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2524899	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:theforeman:foreman:-:*:*:*:*:*:*:*

History

07 Oct 2026, 15:25

Type	Values Removed	Values Added
First Time		Redhat Theforeman Redhat satellite Theforeman foreman
References	~~() https://access.redhat.com/security/cve/CVE-2026-81658 -~~	() https://access.redhat.com/security/cve/CVE-2026-81658 - Vendor Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2524899 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2524899 - Issue Tracking, Vendor Advisory
CPE		cpe:2.3:a:redhat:satellite:6.0:::::::* cpe:2.3:a:theforeman:foreman:-:::::::*

Information

Published : 2026-08-27 13:18

Updated : 2026-10-07 15:25

NVD link : CVE-2026-81658

Mitre link : CVE-2026-81658

CVE.ORG link : CVE-2026-81658

JSON object : View

Products Affected

redhat

satellite

theforeman

foreman

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-81658", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81658", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T14:47:40.754824Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-08-27T13:18:42.037", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-81658", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524899", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup."}], "lastModified": "2026-10-07T15:25:07.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "848C92A9-0677-442B-8D52-A448F2019903"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theforeman:foreman:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD7E727C-BF9F-4A86-BCBE-1CE6E1108181"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}