A vulnerability in Foreman's Api::V2::MailNotificationsController allows insufficient authorization checks on user-specific mail-notification resources. The GET endpoint for user mail notifications does not verify that the authenticated user is authorized to access the target user's notifications. Additionally, the POST and PUT endpoints fail to halt execution after denying access, potentially allowing unauthorized disclosure and modification of another user's mail-notification settings.