An incorrect authorization vulnerability in AWX, the automation controller component of Red Hat Ansible Automation Platform, allows a user with job template administration rights to attach a webhook token credential they do not have permission to use. This flaw can lead to disclosure of another user's personal access token when a webhook event triggers AWX to send the decrypted token to an attacker-controlled destination. The impact is limited to confidentiality of the credential, with no direct integrity or availability effects. Red Hat rates this flaw as Moderate with a CVSS score of 6.5.