JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade automation-eda-controllerUpgrade automation-hubUpgrade automation-gateway-proxy-serverUpgrade receptor-debuginfoUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-gateway-proxy-debugsourceUpgrade automation-controllerUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade automation-eda-controller-baseUpgrade python3.12-galaxy-ngUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-gitpythonUpgrade receptor-debugsourceUpgrade automation-platform-uiUpgrade automation-gateway-configUpgrade automation-gateway-serverUpgrade python3.12-sqlparseUpgrade python3-sqlparseUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-django-ansible-base+activitystreamUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-controller-venv-towerUpgrade automation-controller-uiUpgrade automation-gatewayUpgrade python3.12-django-ansible-base+rbacUpgrade python3.12-django-ansible-baseUpgrade automation-eda-controller-base-servicesUpgrade automation-controller-serverUpgrade automation-gateway-proxyUpgrade receptorUpgrade receptorctlUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-controller-cliUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+resource_registryUpgrade aap-metrics-utilityUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-eda-controller-event-stream-servicesUpgrade automation-gateway-proxy-server-debuginfo | Sep 25, 2026 | Sep 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub