The JobJobEventsChildrenSummary endpoint is missing a model and parent_model definition, causing the ModelAccessPermission.check_get_permissions() method to default to true for any authenticated user. Consequently, basic GET requests return the entire event tree structure, the event_processing_finished flag, and allow enumeration of Job IDs across the entire platform. The view’s use of Django’s raw get_object_or_404(Job, pk) bypasses DRF’s object‑level permission checks, enabling even low‑privileged users to read this sensitive information.

This flaw is present in Red Hat Ansible Automation Platform 2. All installations of version 2 are affected because the error exists in the central automation controller’s job events API. No narrower sub‑version range is specified beyond the major release.

The CVSS score is 5.0, indicating moderate severity, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers only need to be authenticated to the platform; once logged in, any user can query the exposed endpoint and glean cross‑tenant job metadata, enabling reconnaissance and unintended data disclosure rather than direct code execution or denial of service.