Administrator escalation via unchecked usergroup role assignment

Privilege escalation in Red Hat Satellite allows remote authenticated users to gain administrator access through Foreman usergroup APIs. The Foreman Usergroup model accepts role_id and user_id values in a create or update request without checking whether the caller may assign those roles. An account with create_usergroups or edit_usergroups permission can attach the System admin role to a group, join it, and obtain full administrator privileges.