CVE-2026-5138

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5138
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5138.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5138
Downstream
Published
2026-07-01T14:08:43.978Z
Modified
2026-07-15T01:49:04.478861366Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Foreman: foreman: information disclosure via improper validation of nested request parameters
Details

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5138.json",
    "cwe_ids": [
        "CWE-639"
    ],
    "cna_assigner": "redhat"
}
References

Affected packages

Git
github.com/theforeman/foreman

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/foreman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
924f09d6846005f9fa82f06be3e0639b4586e93f
Introduced
d82d6878ac1683790d4ea1e54772e2f047d4254a
Fixed
48b7090bd69c44b7b8fc5ad95ee7be243f852819
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.18.2"
        },
        {
            "introduced": "3.19.0"
        },
        {
            "fixed": "3.19.1"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.1-1
0.1-2
0.1-3
0.1-4
0.1-5
0.1-6
0.2
0.2rc1
0.3
0.4
0.4rc2
0.4rc3
0.4rc4
0.4rc5
1.*
1.0
1.0RC1
1.0RC2
1.0RC3
1.0RC4
1.0RC5
1.1
1.1RC1
1.1RC2
1.1RC3
1.1RC4
1.1RC5
3.*
3.18.0
3.18.0-rc1
3.18.0-rc2
3.18.1
3.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5138.json"
github.com/theforeman/foreman-installer

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/foreman-installer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9bf11d9dadb46b629a9ebaad5efa1cb4f3b18aad
Introduced
c08fe88ada05e9b7fb6f1c4a24d2939f47c7e5c7
Fixed
dd9a3ad4746e606d79b4ced48d1dabdc79a52b49
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.18.2"
        },
        {
            "introduced": "3.19.0"
        },
        {
            "fixed": "3.19.1"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*"
}

Affected versions

1.*
1.0.1
3.*
3.18.0
3.18.0-rc1
3.18.0-rc2
3.18.1
3.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5138.json"
github.com/theforeman/smart-proxy

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/smart-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f9a1c49144fef618282d1466975d0947e234c513
Introduced
8b7a6d6c5955634c2bff9d8789234b0d7c3fe616
Fixed
c5abbd9b13b34e6cd2055920bef27d8f03bbc80a
Database specific 
{
    "cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.18.2"
        },
        {
            "introduced": "3.19.0"
        },
        {
            "fixed": "3.19.1"
        }
    ]
}

Affected versions

0.*
0.1
0.2
0.2rc2
0.3
1.*
1.0
1.0RC1
1.0RC2
1.1
1.1RC1
1.1RC2
1.1RC3
3.*
3.18.0
3.18.0-rc1
3.18.0-rc2
3.18.1
3.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5138.json"