CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks:

can_access(model, 'add', create_kwargs_check)

can_access(model, 'copy_related', obj)

For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on

inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks:

can_access(model, 'add', create_kwargs_check)

can_access(model, 'copy_related', obj)

For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on

inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.

ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration automation-controller: automation-controller-container: automation-controller: JobJobEventsChildrenSummary RBAC bypass exposes cross-tenant job event tree structure automation-controller: automation-controller-container: automation-controller: Any authenticated user reads Red Hat subscription/license details via /config/ automation-controller: automation-controller-container: automation-controller: Verbose internal exception disclosure via HostList bare-Exception handler automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on co…

Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.