CVE-2026-71459

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

CVE-2026-71459

The Red Hat Ansible Automation Platform (automation-controller ) is vulnerable to a cross-tenant job event data exposure due to a missing RBAC check in the JobJobEventsChildrenSummary view. The underlying cause is that the view lacks a model/parent_model definition, causing ModelAccessPermission....