A vulnerability in Foreman's Api::V2::PersonalAccessTokensController allows an attacker with create_personal_access_tokens permission to create a Personal Access Token for another user without proper authorization checks. The plaintext token is returned in the API response, enabling the attacker to authenticate as the victim and potentially take over their account, including administrator accounts.