CVE-2026-76648 Red Hat CVE debrief

Who should care

Defenders and administrators of systems using the affected product should assess exposure and prioritize mitigation, especially in systems handling sensitive data. The vulnerability's existence and impact require verification, and defenders should monitor system logs for potential exploitation attempts. Prioritization is crucial for systems with high sensitivity or those that could be targeted by attackers.

Why it matters

CVE-2026-76648 is a high-severity vulnerability in an unknown vendor's product, potentially allowing unauthorized data access. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems handling sensitive data. The vulnerability's existence and impact require verification, and defenders should monitor system logs for potential exploitation attempts.

• Potential unauthorized data access
• Need for verification of vulnerability existence and impact
• Potential for exploitation attempts
• Priority for applying patches or updates

Technical summary

The CopyAPIView in awx/awx/api/generics.py does not perform object-level RBAC for POST requests. Specifically, the get() handler checks request.user.can_access(obj._class_, 'read', obj), but the post() handler only checks can_access(model, 'add', create_kwargs_check) and can_access(model, 'copy_related', obj). This discrepancy could allow unauthorized data access if an attacker can manipulate the POST request. The vulnerability affects JobTemplate, where can_add gates on inventory.use_role + project.use_role + execution_environment.read_role, and can_copy_related checks only credentials.use_role. None of these checks imply the caller can read the source JobTemplate.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems handling sensitive data.

Recommended defensive actions

• Verify the vulnerability's existence and impact on your systems.
• Check for and apply any available patches or updates.
• Monitor system logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is described in the CVE record and NVD entry, with limited additional information from other sources. The CVE record was published on 2026-09-23T19:19:15.030Z and has not been modified since then. The NVD entry provides further details on the vulnerability's impact and potential exploitation methods. However, due to limited information, defenders should verify the vulnerability's existence and impact on their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.