Authorization Bypass in AWX CopyAPIView

CVE-2026-76648 identifies a critical authorization bypass vulnerability within the CopyAPIView component (located in awx/awx/api/generics.py) of the Ansible AWX platform. The vulnerability stems from an inconsistency in permission enforcement within the component's handlers. While the get() handler correctly enforces object-level Role-Based Access Control (RBAC) using request.user.can_access, the post() handler fails to implement equivalent checks.

When processing copy requests for JobTemplates, the system performs validation against model-level roles like 'add' and 'copy_related', but fails to verify if the user possesses read access to the source object. This allows an authenticated user with limited resource-level permissions (such as inventory or execution environment use roles) to initiate copy operations on JobTemplates for which they do not have authorized access. This bypass leads to unauthorized data operations and potentially facilitates information disclosure or improper state manipulation within the automation environment.

Impact

The vulnerability results in an authorization bypass, enabling users to perform unauthorized copy operations on JobTemplate resources. Successful exploitation could allow unauthorized users to gain visibility into restricted automation templates or manipulate the state of the system by copying sensitive job definitions, undermining the principle of least privilege within the automation pipeline.

Recommendation

Prioritize the identification and implementation of official patches from the AWX project for this authorization flaw. If a patch is not immediately available, restrict access to the affected API endpoints or limit user permissions associated with JobTemplate creation and modification until the system is updated. Audit existing user roles to ensure that access to 'use_role' and 'add' permissions for resources are restricted to authorized personnel.