CopyAPIView lacks an authorization check for POST requests, allowing an authenticated user with add and copy-related permissions to create a copy of a JobTemplate. The copy includes the template's secrets and sensitive configuration, enabling the attacker to recover confidential data that should not be accessible without a read privilege. Because the API does not enforce object-level read permissions, this flaw permits unauthorized disclosure of secrets and could be exploited for privilege escalation. The weakness is a missing authorization check on the copy operation, identified as CWE‑862.

This issue affects Red Hat Ansible Automation Platform 2, specifically the automation controller and container components that expose the Copy API. No further version constraints are listed in the CNA data; the vulnerability applies to all installations of the platform that include the affected code path.

CVSS base score of 8.5 classifies the flaw as high severity. EPSS is not available, but the lack of a publicly known exploit and absence from the CISA KEV catalog suggest moderate to low exploitation likelihood. However, the attack requires an authenticated user who has the 'add' and 'copy_related' permissions on the target resource but not necessarily ‘read’ access. In many environments, users granted such privileges are already elevated, meaning the vulnerability can be used by a privileged account to extract secrets from other job templates. Organizations should assess whether any account has these permissions and consider limiting them until the patch is applied.