Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:22:06 +0000 CVE-2026-76648 — Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read… https://vulnerability.circl.lu/vuln/cve-2026-76648 <p><strong>Affected:</strong> Red Hat Ansible Automation Platform 2.7, Red Hat Ansible Automation Platform 2</p> <p>CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF&#39;s get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, &#39;read&#39;, obj) — but post() (lines 1001–1010) does not. POST only checks:</p> <p>can_access(model, &#39;add&#39;, create_kwargs_check)</p> <p>can_access(model, &#39;copy_related&#39;, obj)</p> <p>For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on</p> <p>inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.</p> <p><strong>Affected:</strong> Red Hat Ansible Automation Platform 2.7, Red Hat Ansible Automation Platform 2</p> <p>CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF&#39;s get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, &#39;read&#39;, obj) — but post() (lines 1001–1010) does not. POST only checks:</p> <p>can_access(model, &#39;add&#39;, create_kwargs_check)</p> <p>can_access(model, &#39;copy_related&#39;, obj)</p> <p>For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on</p> <p>inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.</p> https://vulnerability.circl.lu/vuln/cve-2026-76648