CVE-2026-76648

An IMPORTANT severity flaw was found in the Red Hat Ansible Automation Platform automation controller. The CopyAPIView.post() API handler does not verify that the requesting user has read access to the source object before performing a copy operation, while the corresponding GET handler does enforce this check. As a result, an authenticated user holding only Use roles on a shared project and inventory can copy any Job Template built on those resources, including Job Templates they are not permitted to read, and becomes the administrator of the resulting clone. The clone contains the source Job Template's plaintext host_config_key and extra_vars fields, which frequently contain secrets, and the recovered host_config_key can be used to authenticate against the original Job Template's provisioning callback endpoint. This allows a low-privileged authenticated attacker to disclose highly confidential information and gain limited control over cloned resources (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), which matches the upstream severity. The automation-controller component in Ansible Automation Platform 2.5, 2.6, and 2.7 is affected and fixes are being pursued through the delegated maintenance process. For Ansible Automation Platform 2.4 the fix is deferred, so no update is currently planned for that stream and the authorization gap remains; the residual risk is that users with only resource-level Use roles on shared projects and inventories can recover secrets from Job Templates they cannot read. The automation-controller-cli package in Ansible Automation Platform 2.7 is not affected because the vulnerable code is not in its execution path.