The foreman_ansible plugin's Ansible inventory API in Red Hat Satellite 6 uses an unscoped Host.where call that fails to apply the permission search filter tied to the caller's view_hosts permission. While taxonomy scoping is enforced, the permission filter layer is omitted, enabling authenticated users with filtered view_hosts permissions to query arbitrary host IDs within their organization and retrieve full inventory details, including hidden parameters and Ansible variables flagged as hidden. The hidden flag is intended as a UI convenience but is commonly used to protect sensitive data, making this a data disclosure vulnerability. No custom role configuration is needed to exploit this, as the default "Ansible Tower Inventory Reader" role grants the necessary permission.

An authenticated user with limited host visibility can bypass permission filters to access full Ansible inventory data for hosts outside their permitted view but within their organization. This includes sensitive parameter values marked as hidden, potentially exposing confidential information. The vulnerability leads to unauthorized disclosure of sensitive data but does not impact integrity or availability. The CVSS 3.1 base score is 4.3 (medium severity) reflecting low confidentiality impact and no integrity or availability impact.

Red Hat advises restricting the view_hosts permission for users and roles to only those who require access to the ansible_inventories controller actions. Remove the view_hosts permission from roles of users who do not need Ansible inventory access. Additionally, review and avoid storing high-value credentials or sensitive data in host parameters that are included in inventory outputs. No official patch or fix is currently indicated in the advisory; patch status is not yet confirmed — check the Red Hat advisory for updates.