CVE-2026-76648
Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.
| CWE | CWE-862 |
| Vendor | red hat |
| Product | red hat ansible automation platform 2.7 |
| Published | Sep 23, 2026 |
| Last Updated | Oct 16, 2026 |
Get instant alerts for red hat red hat ansible automation platform 2.7
Be the first to know when new high vulnerabilities affecting red hat red hat ansible automation platform 2.7 are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N