REDHAT-BUG-2547470: Medium severity Foreman Foreman vulnerability

The domain and subnet interface API does not apply the caller's host search filter. Nic::Base has no authorized scope. Api::BaseController#parentscope then keeps only the domain or subnet. The host-nested route does apply the host filter.

The caller must be logged in. They need viewhosts limited by a search, and viewdomains or viewsubnets on a domain or subnet that also has other hosts. An update also needs edithosts. Create and delete look the parent up with editdomains or editsubnets.

Reading another host's interface, and changing its IPv4 address, were demonstrated on Foreman 5.0.0-develop. The host API still hid that host. The subnet case used an IPv4 subnet. Creating or deleting an interface, writing a BMC password, and access across organizations were not demonstrated. The interface response includes a BMC username and omits the password.

Introduced in Foreman 1.7.0 by commit 453dc6939 on 2014-10-14, when the domain and subnet nested interface routes were added. The host-nested route was fixed in 1.12.1 and 1.11.4. This path remains, including on develop at cfc5346d6 (2026-10-07).