{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-76648",
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "state": "PUBLISHED",
        "assignerShortName": "redhat",
        "dateReserved": "2026-08-19T15:34:44.371Z",
        "datePublished": "2026-09-23T18:24:44.006Z",
        "dateUpdated": "2026-10-16T11:51:09.848Z"
    },
    "containers": {
        "cna": {
            "title": "Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read                 authorization check enables job template secret                 recovery",
            "metrics": [
                {
                    "other": {
                        "content": {
                            "value": "Important",
                            "namespace": "https://access.redhat.com/security/updates/classification/"
                        },
                        "type": "Red Hat severity rating"
                    }
                },
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "NONE",
                        "baseScore": 8.5,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "LOW",
                        "privilegesRequired": "LOW",
                        "scope": "CHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                        "version": "3.1"
                    },
                    "format": "CVSS"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes =\n(IsAuthenticated,), so DRF's get_object() performs no object-level\nRBAC. The get() handler (lines 988–991) explicitly guards with\nrequest.user.can_access(obj._class_, 'read', obj) — but post()\n(lines 1001–1010) does not. POST only checks:\n\ncan_access(model, 'add', create_kwargs_check)\n\ncan_access(model, 'copy_related', obj)\n\nFor JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on\n\ninventory.use_role + project.use_role +\nexecution_environment.read_role — resource-level roles that do not\nimply read on the source JT — and can_copy_related (1522–1534) checks\nonly credentials.use_role. None of these imply the caller can read the\nsource JT."
                }
            ],
            "affected": [
                {
                    "vendor": "Red Hat",
                    "product": "Red Hat Ansible Automation Platform 2.7",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "ansible-automation-platform-27/controller-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1789580684",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
                    ]
                },
                {
                    "vendor": "Red Hat",
                    "product": "Red Hat Ansible Automation Platform 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "ansible-automation-platform-26/controller-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:ansible_automation_platform:2"
                    ]
                },
                {
                    "vendor": "Red Hat",
                    "product": "Red Hat Ansible Automation Platform 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "automation-controller",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:ansible_automation_platform:2"
                    ]
                },
                {
                    "vendor": "Red Hat",
                    "product": "Red Hat Ansible Automation Platform 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "automation-controller-cli",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:ansible_automation_platform:2"
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://access.redhat.com/errata/RHSA-2026:71177",
                    "name": "RHSA-2026:71177",
                    "tags": [
                        "vendor-advisory",
                        "x_refsource_REDHAT"
                    ]
                },
                {
                    "url": "https://access.redhat.com/security/cve/CVE-2026-76648",
                    "tags": [
                        "vdb-entry",
                        "x_refsource_REDHAT"
                    ]
                },
                {
                    "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519720",
                    "name": "RHBZ#2519720",
                    "tags": [
                        "issue-tracking",
                        "x_refsource_REDHAT"
                    ]
                }
            ],
            "datePublic": "2026-09-06T00:00:00.000Z",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-862",
                            "description": "Missing Authorization",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "x_redhatCweChain": "CWE-862: Missing Authorization",
            "workarounds": [
                {
                    "lang": "en",
                    "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                }
            ],
            "timeline": [
                {
                    "lang": "en",
                    "time": "2026-08-19T15:34:15.360Z",
                    "value": "Reported to Red Hat."
                },
                {
                    "lang": "en",
                    "time": "2026-09-06T00:00:00.000Z",
                    "value": "Made public."
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Red Hat would like to thank Chris Meyers for reporting this issue."
                }
            ],
            "providerMetadata": {
                "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
                "shortName": "redhat",
                "dateUpdated": "2026-10-16T11:51:09.848Z"
            },
            "x_generator": {
                "engine": "cvelib 1.8.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2026-76648",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2026-09-26T22:45:56.874201Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-09-26T22:51:21.608Z"
                }
            }
        ]
    }
}