ModelAccessPermission.check_get_permissions() falls through
(returns True) for any authenticated user. The view uses
raw get_object_or_404(Job, pk) without DRF object-level
permission check. Zero-privilege user reads event tree
structure, event_processing_finished status, and enumerates
Job IDs platform-wide via 200/404 oracle. Sibling endpoint
/jobs/{id}/job_events/ correctly returns 403.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | affected |
|
||||||
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | affected |
|
||||||
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | affected |
|
||||||
| Red Hat | Red Hat Ansible Automation Platform 2.6 | affected |
|
||||||
| Red Hat | Red Hat Ansible Automation Platform 2.7 | affected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Thu, 24 Sep 2026 06:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:ansible_automation_platform:2.7::el9 | |
| References |
|
Thu, 24 Sep 2026 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 |
|
| References |
|
Wed, 23 Sep 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat ansible Automation Platform Developer
Redhat ansible Automation Platform Inside |
|
| CPEs | cpe:/a:redhat:ansible_automation_platform:2.6::el10 cpe:/a:redhat:ansible_automation_platform:2.6::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9 |
|
| Vendors & Products |
Redhat ansible Automation Platform Developer
Redhat ansible Automation Platform Inside |
|
| References |
|
Wed, 23 Sep 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403. | |
| Title | Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure | |
| First Time appeared |
Redhat
Redhat ansible Automation Platform |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:/a:redhat:ansible_automation_platform:2 | |
| Vendors & Products |
Redhat
Redhat ansible Automation Platform |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-24T06:08:54.832Z
Reserved: 2026-08-06T19:31:51.452Z
Link: CVE-2026-71459
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-23T19:19:02.180
Modified: 2026-09-24T07:16:32.403
Link: CVE-2026-71459
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-23T19:30:08Z