Repository navigation
Conversation
Apply view_job_invocations permission filters when resolving a template invocation and constrain the lookup to a host targeted by the job. Prevent the template-invocation endpoint from returning another user's job details outside the caller's authorized scope. Fixes #39990 - Fix template invocation authorization 92904 Fixes 2a8a05f (cherry picked from commit ab82695)
Apply view_job_invocations permission filters when resolving a template invocation and constrain the lookup to a host targeted by the job. Prevent the template-invocation endpoint from returning another user's job details outside the caller's authorized scope. Refs #39990 - Use database lookup for template invocation Fixes 2a8a05f (cherry picked from commit 80b7fdc)
Apply view_job_invocations permission filters when resolving a template invocation and constrain the lookup to a host targeted by the job. Prevent the template-invocation endpoint from returning another user's job details outside the caller's authorized scope. bundle exec rubocop --auto-correct (cherry picked from commit b8c4093)
CI-only follow-up (no Redmine issue)The two separate CI commits backport changes already merged on REX master: 5248834f and faa4d402. They switch the reusable Ruby workflow to These commits change CI configuration only, not application behavior or runtime dependencies. They retain their original upstream subjects, authorship and public cherry-pick provenance. They have no associated Redmine issue; the security issue must not be used as an unrelated CI reference. Consequently, the Redmine formatting check may fail on these two CI commits. Please assess that separately from application/test CI. Foreman has merged comparable no-issue CI changes with that check failing: #10771, #10881, and the same reusable-workflow upgrade in #11141. This is maintainer-reviewed precedent, not an automated check bypass or a claim that Redmine passes. |
Purpose
Backport of #1080 to
16.6-stablefor CVE-2026-92904.Public issue: https://projects.theforeman.org/issues/39990
Carry the original template-invocation authorization series and the author's lint follow-up as three separate commits. Preserve object-level authorization when looking up template/job invocations instead of relying only on possession of a general permission.
Compatibility and scope
Mainline review is still open. All
-xtrailers reference its actual public commits. No release-specific application adaptation was needed. This backport stays within the supplied mainline series: it does not modify the separate API v2output/raw_outputactions or claim additional coverage for them. Review of that scope remains open; no broader security fix is implied by passing suites.Testing
Full configured Ruby lint, the plugin Ruby/browser suite, webpack compilation, fresh-database seeds, JavaScript lint and JavaScript tests passed locally for this candidate. The affected template-invocation controller tests passed again in the isolated signed-source smoke run. The publication changes metadata only; every commit tree matches the validated stable candidate. These are local results, not a claim about this PR's GitHub Actions.
Review denied access to invocations outside the caller's authorized scope and retained access to permitted invocations. Reconcile any mainline review changes before merging this backport.