CVE-2026-5138

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.

• CWE-639

• https://access.redhat.com/errata/RHSA-2026:34365Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34366Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34367Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34368Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-5138Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2452971Issue Tracking, Vendor Advisory

Published

Jul 1, 2026

Last Modified

Jul 9, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-51304Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2026-5131GREENmod uses named pipes for communication between plugins,…6.9
• CVE-2026-5134Improper neutralization of special elements used in an SQL c…9.8
• CVE-2026-5135A flaw was found in Foreman. This broken access control vuln…6.5
• CVE-2026-5136A flaw was found in Foreman. The Usergroup model in Foreman …8.8
• CVE-2026-5137The RTMKit (rometheme-for-elementor) plugin for WordPress is…4.3
• CVE-2026-51380Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03…9.8
• CVE-2026-51385An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through …6.9
• CVE-2026-51386Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE…
• CVE-2026-5139Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5…5.4
• CVE-2026-5140Improper neutralization of CRLF sequences ('CRLF injection')…8.8
• CVE-2026-51400An issue in Vim Project v9.2.0389 and earlier allows a local…8.4