Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.