CVE-2026-5136

Katalog CVE

CVSS 8.8 · High EPSS 0,56%

Kerentanan Incorrect Privilege Assignment pada redhat satellite, theforeman foreman. Skor CVSS 3.1 8.8 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.

Rincian

Terbit di NVD

1 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:34365 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:34366 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:34367 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:34368 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-5136 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2452970 issue tracking · advisory vendor