CVE-2026-107193: Foreman: api filter lookup ignores a search-limited filter permission
A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.
Other sources
The API loads a filter by id without the caller's search limit. The lookup is Api::V2::FiltersController#resourcescope, which returns every filter. The action check only asks whether the caller has the delete permission at all. Nothing checks that specific filter on delete. A filter on a locked built-in role is still rejected.
The caller must be logged in and must hold a permission to delete filters that is limited by a search, for example to one role.
Deletion of a filter on another unlocked role was demonstrated through the API. The same delete through the web interface was refused. An update that moves a filter onto a role inside the caller's search was read from the code and was not demonstrated.
— Red Hat