CVE-2026-5136

Description

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user-s permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.