CVE-2026-92894: Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction
A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user needs the edit_ansible_variables permission. That permission is sufficient even when the target Ansible variable is outside the user's assigned permission filter scope.
What can an attacker delete?
The attacker can delete any LookupValue record if they know its ID. This includes override values for Ansible variables outside their authorized scope and override values associated with Puppet smart class parameters.
Does exploitation require user interaction or a complex attack path?
No. The issue is remotely reachable over the API, has low attack complexity, and does not require user interaction; however, the attacker must already be authenticated and hold the relevant edit permission.