CVE-2026-92894
4.3 MEDIUMPublished 2026-09-17 · Updated 2026-09-18
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-100371PoC
- UNSCOREDCVE-2026-100392PoC
- MEDIUMCVE-2026-100529PoC
- HIGHCVE-2026-100530PoC
- HIGHCVE-2026-100535PoC
- MEDIUMCVE-2026-100538PoC
- LOWCVE-2026-100539PoC
- MEDIUMCVE-2026-100540PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.