CVE-2026-86323
Last modified
CVE-2026-86323 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. EPSS estimates a 0.36% chance of exploitation in the next 30 days.
Description
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | All versions |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | All versions |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | All versions |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | All versions |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-86323?
How severe is CVE-2026-86323?
How do I fix CVE-2026-86323?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-86318A flaw has been found in java-json-tools json-patch up to 1.…5.3
- CVE-2026-86319A vulnerability has been found in java-json-tools json-patch…5.3
- CVE-2026-8632A potential security vulnerability has been identified in th…7.8
- CVE-2026-86320A flaw was found in flatpak-builder where Git hooks are not …7.8
- CVE-2026-86321A vulnerability was found in java-json-tools jackson-coreuti…5.3
- CVE-2026-86322A flaw was found in Foreman’s Api::V2::PersonalAccessTokensC…8.8
- CVE-2026-86324A flaw was found in Foreman’s Api::V2::SshKeysController, wh…4.3
- CVE-2026-86325A stack-based buffer overflow vulnerability exists in protoc…9.4
- CVE-2026-86326An improper verification of cryptographic signature vulnerab…8.6
- CVE-2026-8633IBM Web Server Plug-ins for WebSphere Application Server and…9.8
- CVE-2026-86330An OS command injection flaw was found in the set_hostname_i…7.2
- CVE-2026-86332A flaw was found in odh-dashboard in Red Hat OpenShift AI. T…6.5
Are you affected by CVE-2026-86323?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST