CVE-2026-86322

{
  "etk_id": "ETK-2026-4320",
  "cve_id": "CVE-2026-86322",
  "display_id": "CVE-2026-86322",
  "ghsa_id": "GHSA-h4jq-48pm-fr95",
  "euvd_id": "EUVD-2026-124675",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Foreman personal access token creation",
  "summary": "Red Hat Satellite 6 deployments using Foreman are affected by an authorization flaw in the personal-access-token API. A user permitted to create personal access tokens may obtain a token for another account and use it as that account; the attacker needs API access and that existing permission.",
  "mitigation": "Restrict the personal-access-token creation permission to trusted administrators and limit access to the affected API. Review and revoke tokens that may have been created for other users, and apply the vendor’s update when a fixed release is provided.",
  "vendor": "Red Hat",
  "product": "Red Hat Satellite 6",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "foreman",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 63.41707328333333,
  "t0_at": "2026-11-12T20:19:29.433000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T20:19:29.433000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T20:19:29.433000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86322"
    }
  }
}