CVE-2026-5136: Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Summary: A privilege escalation flaw was found in Foreman. The Usergroup model does not validate role assignments against the calling user's permissions, unlike the User model which enforces escalation checks. This flaw allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and add themselves as a member, resulting in full privilege escalation to administrator-level access.

Requirements to exploit: Authenticated Foreman account with createusergroups or editusergroups permission (e.g., Site manager, Organization admin, Manager roles, or any custom role including these permissions). Attacker crafts a single API request to create or update a user group with a privileged roleid and their own userid.

— Red Hat