Advisory · CVE-2026-76648
AWX copy endpoint skips object-level access checks
The AWX CopyAPIView POST handler never performs the object-level read check that the GET handler does, letting users copy job templates they are not allowed to read.
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Identifier / CWE
- CVE-2026-76648
CWE-862 - Action timing
- Immediate
Explain it like I’m five
The front door of the copy machine checks your badge, but the copy button itself does not. Anyone who can reach the machine can photocopy documents they were never allowed to read.
- 01Target object
An authenticated low-privilege user identifies a JobTemplate they cannot read.
- 02Copy request
They POST to the CopyAPIView endpoint, which checks only add and copy_related permissions on related resources, never read access on the source object.
- 03Silent copy
The copy succeeds because the resource-level role checks do not imply read on the source job template.
- 04Disclosure
The attacker now owns a copy of the job template and can read its full configuration, including referenced credentials they could not see before.
What happened
The AWX CopyAPIView sets a permissive permission class, and while its GET handler explicitly checks object-level read access, the POST handler does not. Copying a JobTemplate requires only add-style checks on the inventory, project, and execution environment plus copy_related on credentials, none of which imply the caller can read the source job template. A low-privilege authenticated user can therefore duplicate and inspect objects outside their read scope.
Red Hat reports Red Hat Ansible Automation Platform 2 as affected and rates the issue high at CVSS 8.5. Red Hat has not stated a fixed version in the data available, so remediation should follow the vendor bulletin.
What to do
- Follow the Red Hat security bulletin for patches or mitigations and apply them.
- Audit copy operations in the AWX activity stream for objects copied by users outside the owning teams.
- Review credential attachments on job templates that may have been exposed through copied configurations.
- Reassess which roles can reach the copy endpoints until patched.
Management note
Read access is usually the boundary teams reason about, and this flaw quietly removes it for anything copyable. The exposure is configuration and credential references rather than direct code execution, but in an automation platform those two are rarely far apart.