{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-86322","cwes":["CWE-639"],"description":"A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794514769433,"publishedAt":1794514769433,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-86322"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529289"}],"remediation":[],"revision":"5b6a8d630261c16f235b7d17d3836e5fe3f11ac96cdaeaee217ed5a9bd2cd0ec","sources":[{"modifiedAt":1794514769433,"name":"CNA: redhat","retrievedAt":1794517832844,"url":"https://www.cve.org/CVERecord?id=CVE-2026-86322"}],"ssvc":null,"status":"published","title":"Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller","updatedAt":1794517832844}