The vulnerability resides in the Hub collection module documentation renderer of the Ansible Automation Platform UI. When a collection includes a documentation link that contains a script-executing URL scheme, the renderer outputs the link without sanitizing the protocol, allowing an attacker to store malicious JavaScript. When another authenticated user views and activates that link, the script executes in the same origin as the Hub UI, potentially compromising the user’s session and allowing data theft or further attacks. This is a stored cross‑site scripting flaw (CWE‑79) that can affect confidentiality, integrity, and availability of the UI session.

Red Hat Ansible Automation Platform versions 2.6 and 2.7 are affected. The issue exists in the AAP 2.6 and 2.7 release branches and affects all deployments of the Unified UI that use Hub collection documentation rendering.

The CVSS score of 5.4 indicates a medium severity flaw. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting it is not widely exploited at this time but remains a legitimate threat. The attack vector requires an authenticated user with the ability to create or modify a collection containing malicious documentation, and another authenticated user who visits the collection’s documentation page to trigger execution. Because the script runs in the same origin, successful exploitation can lead to credential theft, session hijacking, and potentially full system compromise if privileged user interactions occur. The risk is moderate, but the potential impact warrants timely remediation.