A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.

Summary: A cross-tenant information disclosure flaw was found in Foreman. The taxonomyscope controller method does not validate organization and location IDs from nested request parameters against the current user's taxonomy memberships, bypassing the existing settaxonomy authorization check. This flaw allows an authenticated user with host-edit permissions to leak infrastructure metadata such as subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs from organizations and locations they do not belong to.

Requirements to exploit: Authenticated Foreman account with createhosts or edithosts permission (or equivalent hostgroup permissions) in at least one organization. Attacker crafts a single HTTP request with a valid own-org ID at the top level and a foreign org ID in nested params.