The Ansible inventory API in foremanansible builds its host set via Host.where(conditionkey => ids) in the showinventory private method of AnsibleInventoriesController. The beforeaction :authorize filter only confirms the caller holds a viewhosts permission covering the controller action; it does not apply any filter attached to that permission. The taxonomy default scope on Host::Base limits results to the caller's organizations and locations, so this does not cross org/location boundaries. However, a user whose viewhosts is narrowed by a filter (e.g., hostgroup, lifecycle environment, or name pattern) can supply arbitrary host IDs within their organizations and receive full Ansible inventory including parameters flagged as hidden (real values, not masked) and Ansible variable values with hiddenvalue? set.

The correctly scoped pattern Host.authorized(:viewhosts) is used elsewhere in the same plugin (ApiCommon#findhostansiblerole). The built-in "Ansible Tower Inventory Reader" role includes viewhosts, making the endpoint reachable without custom roles. No non-default configuration is required.

Introduced in foremanansible 3.0.1 (commit 13a1529, 2019-06-27, PR #265) when the inventory preview feature was first created. All versions from 3.0.1 through at least 18.0.2 are affected.