CVE-2016-2100: Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or del...

Security readout for executives and security teams

This Foreman flaw lets an authenticated user with bookmark edit or delete permissions access private bookmarks that should remain private. The described impact is limited to bookmark confidentiality and integrity, not full system compromise. No source in the bundle reports active exploitation. Exposure is likely limited to organizations running affected Foreman versions with authenticated users granted edit_bookmarks or destroy_bookmarks permissions. Internet exposure matters less than account and role exposure because the issue requires authentication. Prioritize remediation where Foreman has many delegated users or shared administrative roles. This is not evidenced as actively exploited, but it can expose or alter private operational bookmarks. Mitigation focus: Upgrade Foreman to 1.10.3, 1.11.0-RC2, or a later fixed release.; Review vendor guidance from Foreman and Red Hat before applying operational changes.; Temporarily restrict edit_bookmarks and destroy_bookmarks permissions to trusted administrators..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.