CVE-2016-4451

—

CVSS 3.0

5.0 medium

EPSS

<1%p59

Published

Aug 19, 2016 (Aug 19, 2016)

Modified

Jun 17, 2026

Description

The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

Vendors: theforeman
Products: foreman
Weakness: CWE-254
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.