The vulnerability exists in the foreman_ansible plugin's Ansible override values API within Red Hat Satellite 6. Specifically, the destroy action resolves the target LookupValue record by ID without verifying that it belongs to an AnsibleVariable the caller is authorized to edit. This flaw allows an authenticated user with the edit_ansible_variables permission to delete any LookupValue by ID, including those outside their permission filter scope and those belonging to Puppet smart class parameters. The create and update actions correctly enforce authorization, indicating the destroy action's lack of scoping is an oversight. The vulnerability affects integrity by allowing unauthorized deletion of configuration override values, which can be recovered by re-creation. No confidentiality or availability impacts are present.

An authenticated user with the edit_ansible_variables permission can delete override values for Ansible variables and Puppet smart class parameters outside their authorized scope. This unauthorized deletion affects the integrity of configuration data but does not impact confidentiality or availability. Deleted override values can be restored by re-creating them.

Restrict the edit_ansible_variables permission to trusted users only. Review assignments of the built-in "Ansible Roles Manager" role, which includes this permission and grants access to the vulnerable destroy action. No official patch or fix is currently confirmed; therefore, access control is the primary mitigation. Check the Red Hat advisory for updates on patch availability.