The vulnerability in Red Hat Ansible Automation Platform 2 arises because the JobJobEventsChildrenSummary view does not specify a model or parent_model, causing ModelAccessPermission.check_get_permissions() to default to returning True for any authenticated user. This view uses a raw get_object_or_404(Job, pk) call without enforcing Django REST Framework object-level permission checks. Consequently, a user with minimal privileges can read sensitive job event tree structures, the event_processing_finished status, and enumerate job IDs platform-wide by leveraging HTTP 200/404 responses. A sibling endpoint (/jobs/{id}/job_events/) correctly returns HTTP 403, indicating proper authorization enforcement there. The issue is classified under CWE-862 (Missing Authorization).

An attacker with low privileges can access sensitive information about job event trees and statuses across tenants, potentially exposing cross-tenant data. The vulnerability does not allow modification or disruption of data or services but leaks confidential information. The CVSS v3.1 score is 5.0 (medium), reflecting a network attack vector, low complexity, low privileges required, no user interaction, changed scope, and limited confidentiality impact.

The vendor advisory does not explicitly state the availability of a patch or fix. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71459 for current remediation guidance. Until a fix is available, restrict access to the affected view or implement additional access controls to prevent unauthorized enumeration of job events. Monitor Red Hat communications for updates on fixes or mitigations.