The flaw in Ansible Lightspeed API conversation endpoints permits an authenticated user to probe conversation identifiers that do not belong to them; as a result the requester can read or alter other users’ AI chat sessions. The lack of proper object‑level authorization leads to a breach of confidentiality and the integrity of AI‑generated output. This weakness corresponds to CWE‑283.

Affected product: Red Hat Ansible Automation Platform 2. No specific version range is listed in the CVE data. Systems running the platform in conjunction with the lightspeed API should be reviewed for potential exposure.

The CVSS base score of 4.2 indicates low overall severity, and an EPSS score of less than 1% shows that exploitation likelihood is very low at present. The vulnerability is not cataloged in KEV, and the attack vector requires valid credentials to the platform, so an attacker must first obtain legitimate login credentials or otherwise authenticate to the API. No public exploit is known, but the impact could be significant once a user attains access rights.