CVE-2026-5136
This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.56% probability · 45th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-266
- Affected
- redhat/satellite · theforeman/foreman
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2026:34365Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34366Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34367Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34368Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5136Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452970Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.