Red Hat Satellite Personal Access Token Api::V2::PersonalAccessTokensController.rb UserAware#find_user user_id improper authorization

Summaryinfo

A vulnerability classified as very critical has been found in Red Hat Satellite. This impacts the function Foreman::Controller::UserAware#find_user of the file Api::V2::PersonalAccessTokensController.rb of the component Personal Access Token. Performing a manipulation of the argument user_id results in improper authorization. This vulnerability was named CVE-2026-86322. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Red Hat Satellite (version now known). It has been classified as very critical. This affects the function Foreman::Controller::UserAware#find_user of the file Api::V2::PersonalAccessTokensController.rb of the component Personal Access Token. The manipulation of the argument user_id with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.

The advisory is shared at access.redhat.com. This vulnerability is uniquely identified as CVE-2026-86322 since 09/07/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/12/2026). MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Red Hat

Name

• Satellite

License

• commercial

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion