CVE-2026-92904

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.

• CWE-863

• https://access.redhat.com/security/cve/CVE-2026-92904
• https://bugzilla.redhat.com/show_bug.cgi?id=2535942

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92892Potential arbitrary code execution under specific configurat…9
• CVE-2026-92893A flaw was found in the foreman_ansible plugin's Ansible inv…4.3
• CVE-2026-92894A flaw was found in the foreman_ansible plugin's Ansible ove…4.3
• CVE-2026-92899Apache WSS4J remembers the Nonce of each UsernameToken it ac…4.8
• CVE-2026-9290The WP User Manager – User Profile Builder & Membership plug…7.5
• CVE-2026-92903Improper input validation in Snowflake CLI versions prior to…8.2
• CVE-2026-92905ZohoCorp ManageEngine EventLog Analyzer and Log360 before bu…5.3
• CVE-2026-92908Adobe Commerce is affected by an Incorrect Authorization vul…8.3
• CVE-2026-92909Adobe Commerce is affected by an Incorrect Authorization vul…9.8
• CVE-2026-9291Insecure deserialization in the job results processing compo…7.5
• CVE-2026-92910Adobe Commerce is affected by an Incorrect Authorization vul…7.2
• CVE-2026-92911Adobe Commerce is affected by a stored Cross-Site Scripting …8.7