The vulnerability lies in the URLModificationMiddleware, which resolves named‑URL lookups against Model objects before applying RBAC checks. A 403 to 404 shim rewrites 403 responses but leaves a pk=0 miss path that returns a different 404 detail string. The distinction between a generic "Not found." response and a specific "No <Model> matches…" response reveals whether a named resource such as an organization, credential, inventory, or host exists anywhere on the platform. This allows an attacker to enumerate internal host names and other resources across tenant boundaries, providing sensitive information for further attacks.

The flaw affects all installations of Red Hat Ansible Automation Platform 2. No specific patch level is supplied, so any platform version in use without a recent fix is vulnerable.

With a CVSS score of 5, the vulnerability is of moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack requires access to the platform’s API or web interface and the ability to observe 404 responses. The impact is limited to information disclosure but could aid in reconnaissance or privilege escalation within the ecosystem.