CVE-2016-4475

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-08-19 · updated 2026-06-17
Weakness: CWE-254

Description

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Affected products

foreman: through 1.11.3; 1.12.0

References

http://projects.theforeman.org/issues/15268
http://projects.theforeman.org/projects/foreman/repository/revisions/a30ab44ed6f140f1791afc51a1e448afc2ff28f9
http://www.securityfocus.com/bid/92125
https://access.redhat.com/errata/RHBA-2016:1615
https://theforeman.org/security.html#2016-4475
http://projects.theforeman.org/issues/15268
http://projects.theforeman.org/projects/foreman/repository/revisions/a30ab44ed6f140f1791afc51a1e448afc2ff28f9
http://www.securityfocus.com/bid/92125
https://access.redhat.com/errata/RHBA-2016:1615
https://theforeman.org/security.html#2016-4475

Get alerted when CVE-2016-4475 or the next vulnerability affects your stack