CVE-2026-107203: Foreman: domain and subnet interface api skips host search filters
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.
Other sources
The domain and subnet interface API does not apply the caller's host search filter. Nic::Base has no authorized scope. Api::BaseController#parentscope then keeps only the domain or subnet. The host-nested route does apply the host filter.
The caller must be logged in. They need viewhosts limited by a search, and viewdomains or viewsubnets on a domain or subnet that also has other hosts. An update also needs edithosts. Create and delete look the parent up with editdomains or editsubnets.
Reading another host's interface, and changing its IPv4 address, were demonstrated on Foreman 5.0.0-develop. The host API still hid that host. The subnet case used an IPv4 subnet. Creating or deleting an interface, writing a BMC password, and access across organizations were not demonstrated. The interface response includes a BMC username and omits the password.
Introduced in Foreman 1.7.0 by commit 453dc6939 on 2014-10-14, when the domain and subnet nested interface routes were added. The host-nested route was fixed in 1.12.1 and 1.11.4. This path remains, including on develop at cfc5346d6 (2026-10-07).
— Red Hat