CVE-2026-5136
Last modified
CVE-2026-5136 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Satellite | >= 6.16, < 6.16.10 |
| Redhat | Satellite | >= 6.17, < 6.17.9 |
| Redhat | Satellite | >= 6.18, < 6.18.7 |
| Redhat | Satellite | >= 6.19, < 6.19.2 |
| Theforeman | Foreman | < 3.18.2 |
| Theforeman | Foreman | >= 3.19.0, < 3.19.1 |
References
- https://access.redhat.com/errata/RHSA-2026:34365Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34366Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34367Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34368Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5136Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452970Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-5136?
How severe is CVE-2026-5136?
How do I fix CVE-2026-5136?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-51302Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51303Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51304Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-5131GREENmod uses named pipes for communication between plugins,…6.9
- CVE-2026-5134Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-5135A flaw was found in Foreman. This broken access control vuln…6.5
- CVE-2026-5137The RTMKit (rometheme-for-elementor) plugin for WordPress is…4.3
- CVE-2026-5138A flaw was found in Foreman. An authenticated user with host…4.3
- CVE-2026-51380Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03…9.8
- CVE-2026-51385An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through …6.9
- CVE-2026-51386Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE…
- CVE-2026-5139Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5…5.4
Are you affected by CVE-2026-5136?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST