JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-gitpythonUpgrade automation-eda-controller-worker-servicesUpgrade receptor-debuginfoUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-eda-controller-baseUpgrade automation-gateway-serverUpgrade automation-gateway-proxy-serverUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-galaxy-ngUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-controllerUpgrade automation-gateway-proxy-debugsourceUpgrade automation-eda-controllerUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade automation-platform-uiUpgrade python3.12-sqlparseUpgrade receptor-debugsourceUpgrade automation-gateway-configUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-hubUpgrade python3-sqlparseUpgrade python3.12-django-ansible-base+redis_clientUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-controller-venv-towerUpgrade python3.12-django-ansible-baseUpgrade automation-gateway-proxyUpgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-django-ansible-base+feature_flagsUpgrade receptorUpgrade python3.12-django-ansible-base+rbacUpgrade receptorctlUpgrade aap-metrics-utilityUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-controller-cliUpgrade automation-controller-uiUpgrade automation-eda-controller-base-servicesUpgrade automation-controller-serverUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-gateway | Sep 25, 2026 | Sep 6, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub