The vulnerability arises because the CopyAPIView in Red Hat Ansible Automation Platform 2 sets permission_classes to IsAuthenticated, which does not enforce object-level RBAC in DRF's get_object(). The GET handler explicitly checks if the user can read the object, but the POST handler does not perform a read authorization check on the source Job Template. Instead, POST checks only if the user can add the model or copy related credentials, which do not guarantee read access to the source Job Template. This missing authorization check can lead to unauthorized reading of sensitive Job Template data, including secrets. The issue is tracked as CWE-862 (Missing Authorization).

An attacker with low privileges can exploit this vulnerability to read sensitive data from Job Templates that they are not authorized to access, potentially exposing secrets and confidential information. The CVSS 3.1 score is 8.5 (high), reflecting network attack vector, low complexity, low privileges required, no user interaction, changed scope, high confidentiality impact, low integrity impact, and no availability impact.

Red Hat has published an advisory for CVE-2026-76648. The advisory does not explicitly state that a fix is available yet. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-76648 for current remediation guidance. Until a fix is released, users should monitor the advisory for updates and consider restricting access to Job Template copy functionality to trusted users only.