The vulnerability arises from the taxonomy_scope controller method in Foreman not properly validating organization and location IDs received via nested request parameters. This improper validation enables an authenticated user with host-edit permissions to bypass authorization controls and access sensitive infrastructure metadata belonging to other tenants. The disclosed information includes network topology details and configuration data that should be restricted. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges but no user interaction. No official remediation or patch information is provided in the vendor advisory at this time.

An attacker with authenticated host-edit permissions can bypass authorization checks to access sensitive infrastructure metadata from organizations and locations they are not authorized to view. This information disclosure could aid in further reconnaissance or targeted attacks but does not directly impact integrity or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5138 for current remediation guidance. Until a fix is available, restrict host-edit permissions to trusted users only to minimize exposure.