A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion crass: crass: Denial of Service via crafted scientific notation in CSS crass: crass: Denial of Service via excessive recursion when processing comments puma: Puma: HTTP Request Smuggling via Underscore Header Name Confusion foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects pyjwt: PyJWT: Authentication bypass via improper public key validation pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets pulp-rpm: Distribution tree publish creates directories from .treeinfo ids candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter…