Fixes #39481 - CVE-2026-5138: Information disclosure via nested request parameters

app/controllers/application_controller.rb

@@ -373,22 +373,29 @@ def errors_hash(errors)
 
   def taxonomy_scope
     if params[controller_name.singularize.to_sym]
-      @organization = Organization.find_by_id(params[controller_name.singularize.to_sym][:organization_id])
-      @location     = Location.find_by_id(params[controller_name.singularize.to_sym][:location_id])
+      @organization = find_user_taxonomy(Organization, params[controller_name.singularize.to_sym][:organization_id])
+      @location     = find_user_taxonomy(Location, params[controller_name.singularize.to_sym][:location_id])
     end
 
     if instance_variable_get("@#{controller_name}").present?
       @organization ||= instance_variable_get("@#{controller_name}").organization
       @location     ||= instance_variable_get("@#{controller_name}").location
     end
 
-    @organization ||= Organization.find_by_id(params[:organization_id]) if params[:organization_id]
-    @location     ||= Location.find_by_id(params[:location_id])         if params[:location_id]
+    @organization ||= find_user_taxonomy(Organization, params[:organization_id])
+    @location     ||= find_user_taxonomy(Location, params[:location_id])
 
     @organization ||= Organization.current
     @location     ||= Location.current
   end
 
+  def find_user_taxonomy(taxonomy_class, id)
+    return if id.blank? || User.current.nil?
+
+    user_taxonomies = User.current.public_send("my_#{taxonomy_class.to_s.underscore.pluralize}")
+    user_taxonomies.find_by(:id => id)
+  end
+
   def parameter_filter_context
     Foreman::ParameterFilter::Context.new(:ui, controller_name, params[:action])
   end

app/controllers/concerns/foreman/controller/host_form_common.rb

@@ -33,17 +33,17 @@ def set_class_variables(host)
 
   def taxonomy_scope
     if params[:host]
-      @organization = Organization.find_by_id(params[:host][:organization_id])
-      @location = Location.find_by_id(params[:host][:location_id])
+      @organization = find_user_taxonomy(Organization, params[:host][:organization_id])
+      @location     = find_user_taxonomy(Location, params[:host][:location_id])
     end
 
     if @host
       @organization ||= @host.organization
       @location     ||= @host.location
     end
 
-    @organization ||= Organization.find_by_id(params[:organization_id]) if params[:organization_id]
-    @location     ||= Location.find_by_id(params[:location_id])         if params[:location_id]
+    @organization ||= find_user_taxonomy(Organization, params[:organization_id])
+    @location     ||= find_user_taxonomy(Location, params[:location_id])
 
     @organization ||= Organization.current
     @location     ||= Location.current

test/controllers/hostgroups_controller_test.rb

@@ -145,6 +145,29 @@ def setup_user(operation, type = 'hostgroups')
     assert_empty JSON.parse(response.body)
   end
 
+  test "domain_selected json must not allow nested organization outside user taxonomies" do
+    org1 = taxonomies(:organization1)
+    org2 = taxonomies(:organization2)
+    loc1 = taxonomies(:location1)
+    subnet_name = "foreign_subnet_taxonomy_scope"
+    domain_id = as_admin do
+      domain = FactoryBot.create(:domain, organizations: [org2], locations: [loc1])
+      subnet = FactoryBot.create(:subnet_ipv4, name: subnet_name, organizations: [org2], locations: [loc1])
+      domain.subnets << subnet
+      domain.save!
+      domain.id
+    end
+    setup_user "edit", "hostgroups"
+    post :domain_selected, params: {
+      organization_id: org1.id,
+      hostgroup: { organization_id: org2.id },
+      domain_id: domain_id,
+      format: :json,
+    }, session: set_session_user(:one), xhr: true
+    assert_response :success
+    refute_includes JSON.parse(response.body).map { |row| row["name"] }, subnet_name
+  end
+
   test "architecture_selected should not fail when no architecture selected" do
     post :architecture_selected, params: { :id => hostgroups(:common), :hostgroup => { :architecture_id => nil }}, session: set_session_user
     assert_response :success