CVE-2026-71367 is an incorrect authorization vulnerability in AWX's WebSocket consumer that allows authenticated users in multi-organization deployments to subscribe to global broadcast groups without proper permission checks. This leads to unauthorized access to real-time job status metadata across organizations, including job IDs, status changes, timestamps, and infrastructure details. The vulnerability does not expose full job outputs or credentials. It mainly impacts multi-organization and managed service deployments, while single-organization setups are not practically affected.