CVE-2026-81658: Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.
Other sources
The reported issue is a valid object-level authorization bypass in Foreman's template revision handling.
TemplatesController#revision (app/controllers/templatescontroller.rb) loads the requested audit with Audit.find(params[:version]). The corresponding API controllers use Audit.authorized(:viewauditlogs).find(params[:version]). The UI action is a collection endpoint and is not subject to findresource, so authorization checks only whether the user may invoke the action (for example viewptables). It does not authorize the specific audit object supplied by the user.
An authenticated, low-privileged user with a template permission such as viewptables, scoped to one organization or location, can therefore retrieve a historical template revision from another organization or location by supplying its audit identifier. This is possible without viewauditlogs and without access to the template through the normal template API. The same revision action is inherited by partition table, provisioning template, report template, and remote execution job template controllers.
The exposed data is the historical template content, which may include sensitive configuration, credentials, or other secrets depending on customer configuration. This unrestricted lookup has been present since the introduction of STI templates.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have a low-privileged template-related permission, such as view_ptables. They also need to supply the audit ID for the historical template revision they want to retrieve.
Is the REST API affected?
The REST API revision endpoints correctly restrict audit lookups using authorization for viewing audit logs. The affected path is the UI template revision action, which looks up the requested audit ID without object-level authorization.
What information could be exposed?
An affected user can retrieve historical template contents from another organization or location. Those revisions may contain sensitive configuration information, credentials, or other secrets.