(IsAuthenticated,), so DRF's get_object() performs no object-level
RBAC. The get() handler (lines 988–991) explicitly guards with
request.user.can_access(obj._class_, 'read', obj) — but post()
(lines 1001–1010) does not. POST only checks:
can_access(model, 'add', create_kwargs_check)
can_access(model, 'copy_related', obj)
For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on
inventory.use_role + project.use_role +
execution_environment.read_role — resource-level roles that do not
imply read on the source JT — and can_copy_related (1522–1534) checks
only credentials.use_role. None of these imply the caller can read the
source JT.
Metrics
Affected Vendors & Products
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Wed, 23 Sep 2026 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT. | |
| Title | Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery | |
| First Time appeared |
Redhat
Redhat ansible Automation Platform |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:/a:redhat:ansible_automation_platform:2 | |
| Vendors & Products |
Redhat
Redhat ansible Automation Platform |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-23T18:24:44.006Z
Reserved: 2026-08-19T15:34:44.371Z
Link: CVE-2026-76648
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-23T19:19:15.030
Modified: 2026-09-23T19:40:10.000
Link: CVE-2026-76648
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-23T19:45:08Z