Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.

CloudForms: Cross Site Scripting in report menu title / HTML Code Injection CloudForms: Business logic bypass through widgets CloudForms: Missing functional level access control & IDOR lead to compromise CloudForms: CSV Injection in Orchestration Templates CloudForms: Missing access control leads to escalation of admin group privileges CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider CloudForms: Out-of-band OS Command Injection through conversion host CloudForms: User Impersonation in the API for OIDC and SAML