CVE-2026-107193

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107193", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-07T13:39:55.503Z", "datePublished": "2026-10-12T05:10:27.265Z", "dateUpdated": "2026-11-13T00:17:27.137Z"}, "containers": {"cna": {"title": "Foreman: api filter lookup ignores a search-limited filter permission", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "foreman", "defaultStatus": "affected", "versions": [{"version": "0:3.12.0.26-1.el8sat", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "foreman", "defaultStatus": "affected", "versions": [{"version": "0:3.12.0.26-1.el9sat", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "foreman", "defaultStatus": "affected", "versions": [{"version": "0:3.14.0.26-1.el9sat", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.17::el9", "cpe:/a:redhat:satellite_capsule:6.17::el9", "cpe:/a:redhat:satellite_maintenance:6.17::el9", "cpe:/a:redhat:satellite_utils:6.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "foreman", "defaultStatus": "affected", "versions": [{"version": "0:3.16.0.29-1.el9sat", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:satellite:6.18::el9", "cpe:/a:redhat:satellite_capsule:6.18::el9", "cpe:/a:redhat:satellite_maintenance:6.18::el9", "cpe:/a:redhat:satellite_utils:6.18::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:99949", "name": "RHSA-2026:99949", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99950", "name": "RHSA-2026:99950", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99952", "name": "RHSA-2026:99952", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-107193", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547437", "name": "RHBZ#2547437", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-12T04:56:40.790Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key", "workarounds": [{"lang": "en", "value": "Filter creation, update, and deletion are audited with the role. Review recent filter audit records for deletions and role changes by delegated filter administrators. Removing those two permissions from delegated roles, or leaving them unlimited and held only by fully trusted administrators, closes the path until a fix is available."}], "timeline": [{"lang": "en", "time": "2026-10-07T13:25:38.338Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-12T04:56:40.790Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Wenhao Wu (Southeast University) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-13T00:17:27.137Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T14:33:20.102233Z", "id": "CVE-2026-107193", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T14:36:44.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Foreman: api filter lookup ignores a search-limited filter permission", "credits": [{"lang": "en", "value": "Red Hat would like to thank Wenhao Wu (Southeast University) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "foreman", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-10-07T13:25:38.338Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-12T04:56:40.790Z", "value": "Made public."}], "datePublic": "2026-10-12T04:56:40.790Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-107193", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547437", "name": "RHBZ#2547437", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Filter creation, update, and deletion are audited with the role. Review recent filter audit records for deletions and role changes by delegated filter administrators. Removing those two permissions from delegated roles, or leaving them unlimited and held only by fully trusted administrators, closes the path until a fix is available."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-12T05:10:27.265Z"}, "x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107193", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T14:33:20.102233Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-13T14:36:38.920Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-107193", "state": "PUBLISHED", "dateUpdated": "2026-10-12T05:10:27.265Z", "dateReserved": "2026-10-07T13:39:55.503Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-12T05:10:27.265Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"], "defaultStatus": "affected", "packageName": "foreman", "product": "Red Hat Satellite 6.16 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.12.0.26-1.el8sat", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"], "defaultStatus": "affected", "packageName": "foreman", "product": "Red Hat Satellite 6.16 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.12.0.26-1.el9sat", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6.17::el9", "cpe:/a:redhat:satellite_capsule:6.17::el9", "cpe:/a:redhat:satellite_maintenance:6.17::el9", "cpe:/a:redhat:satellite_utils:6.17::el9"], "defaultStatus": "affected", "packageName": "foreman", "product": "Red Hat Satellite 6.17 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.14.0.26-1.el9sat", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6.18::el9", "cpe:/a:redhat:satellite_capsule:6.18::el9", "cpe:/a:redhat:satellite_maintenance:6.18::el9", "cpe:/a:redhat:satellite_utils:6.18::el9"], "defaultStatus": "affected", "packageName": "foreman", "product": "Red Hat Satellite 6.18 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.16.0.29-1.el9sat", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted."}], "id": "CVE-2026-107193", "lastModified": "2026-11-13T02:18:49.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107193", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T14:33:20.102233Z", "version": "2.0.3"}}]}, "published": "2026-10-12T06:16:58.463", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99949"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99950"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99952"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-107193"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547437"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Wenhao Wu (Southeast University) for reporting this issue.", "bugzilla": {"description": "foreman: API filter lookup ignores a search-limited filter permission", "id": "2547437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547437"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted."], "mitigation": {"lang": "en:us", "value": "Filter creation, update, and deletion are audited with the role. Review recent filter audit records for deletions and role changes by delegated filter administrators. Removing those two permissions from delegated roles, or leaving them unlimited and held only by fully trusted administrators, closes the path until a fix is available."}, "name": "CVE-2026-107193", "package_state": [{"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-12T04:56:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107193\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107193"], "statement": "Red Hat Product Security has rated this vulnerability with a Moderate security impact. This vulnerability affects Foreman's permission-filter handling.\nA caller must already hold a permission to delete filters that is limited by a search, such as to a single role. This is the documented way to delegate administration of filters for one role. The caller can delete filter records on unlocked roles outside their search. Those roles lose the permissions the filters granted. That is a direct change to who can do what in Foreman.\n```\nThe vulnerable code was introduced in Foreman 1.19.0 when filter display was changed to ignore. All Foreman versions from 1.19.0 onward contain this lookup.\n```", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "satellite", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 91.0, "source": "matching"}]}, "original": {"product": "Red Hat Satellite 6", "source": "cna", "vendor": "Red Hat"}, "product": "foreman", "vendor": "theforeman"}], "created": "2026-10-12T07:00:05.013050+00:00", "updated": "2026-10-13T07:56:32.314682+00:00", "vendors": ["redhat", "redhat$PRODUCT$satellite", "theforeman", "theforeman$PRODUCT$foreman"]}