The vulnerability CVE-2024-7143 affects the Pulp package's RBAC implementation in Red Hat Ansible Automation Platform 2.4. When a role-based access control object assigns permissions upon creation, it uses the AutoAddObjPermsMixin method, which determines the current user by checking the oldest user with any permissions on the task object rather than the actual task dispatcher. Consequently, permissions for newly created objects within tasks are incorrectly assigned to this oldest user, and the actual creator receives no permissions. This misassignment can disrupt intended access controls. Red Hat has issued a security advisory and released updates including automation-controller 4.5.11 and python3-pulpcore 3.28.32 to fix this issue.

The vulnerability causes incorrect assignment of RBAC permissions on objects created within tasks, potentially granting permissions to an unintended user (the oldest user with task permissions) and denying permissions to the actual creator. This can lead to unauthorized access or operational issues due to permission mismanagement. The CVSS 3.0 score of 6.7 reflects a medium severity with high confidentiality and integrity impact and low availability impact. There are no known exploits in the wild at this time.

An official fix is available from Red Hat. Users should apply the updates provided in Red Hat Ansible Automation Platform 2.4, specifically automation-controller version 4.5.11 and python3-pulpcore version 3.28.32 or later, as detailed in Red Hat advisory RHSA-2024:6765. Applying these updates will correct the RBAC permission assignment behavior. No additional mitigation steps are indicated by the vendor advisory.