{"id":"CVE-2024-7143","aliases":["EUVD-2024-2549","GHSA-9m5j-4xx9-44j9","PYSEC-2026-1808","RHSA-2024:6765"],"status":"published","title":"Pulpcore: rbac permissions incorrectly assigned in tasks that create objects","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","severity":{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00605,"percentile":0.49276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-277"],"published":"2024-08-07T16:49:29Z","modified":"2026-10-28T02:30:59Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.56.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.56.0"}]}],"versions":["3.0.0","3.0.0b1","3.0.0b10","3.0.0b11","3.0.0b12","3.0.0b13","3.0.0b14","3.0.0b15","3.0.0b16","3.0.0b17","3.0.0b18","3.0.0b19","3.0.0b2","3.0.0b20","3.0.0b21","3.0.0b22","3.0.0b23","3.0.0b3","3.0.0b4","3.0.0b5","3.0.0b6","3.0.0b7","3.0.0b8","3.0.0b9","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.0rc4","3.0.0rc5","3.0.0rc6","3.0.0rc7","3.0.0rc8","3.0.0rc9","3.0.1","3.1.0","3.1.1","3.10.0","3.11.0","3.11.0.post0","3.11.1","3.11.2","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.14.1","3.14.10","3.14.11","3.14.12","3.14.13","3.14.14","3.14.15","3.14.16","3.14.17","3.14.18","3.14.19","3.14.2","3.14.3","3.14.4","3.14.5","3.14.6","3.14.7","3.14.8","3.14.9","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.15.9","3.16.0","3.16.1","3.16.10","3.16.11","3.16.12","3.16.13","3.16.14","3.16.15","3.16.16","3.16.17","3.16.18","3.16.19","3.16.2","3.16.20","3.16.21","3.16.22","3.16.23","3.16.24","3.16.3","3.16.4","3.16.5","3.16.6","3.16.7","3.16.8","3.16.9","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.1","3.18.10","3.18.11","3.18.12","3.18.13","3.18.14","3.18.15","3.18.16","3.18.17","3.18.18","3.18.19","3.18.2","3.18.20","3.18.21","3.18.22","3.18.23","3.18.24","3.18.25","3.18.26","3.18.27","3.18.28","3.18.29","3.18.3","3.18.30","3.18.31","3.18.32","3.18.33","3.18.34","3.18.35","3.18.4","3.18.5","3.18.6","3.18.7","3.18.8","3.18.9","3.19.0","3.19.1","3.2.0","3.2.1","3.20.0","3.21.0","3.21.1","3.21.10","3.21.11","3.21.12","3.21.13","3.21.14","3.21.15","3.21.16","3.21.17","3.21.18","3.21.19","3.21.2","3.21.20","3.21.21","3.21.22","3.21.23","3.21.24","3.21.25","3.21.26","3.21.29","3.21.3","3.21.30","3.21.31","3.21.32","3.21.33","3.21.34","3.21.35","3.21.36","3.21.4","3.21.5","3.21.6","3.21.7","3.21.8","3.21.9","3.22.0","3.22.1","3.22.10","3.22.11","3.22.12","3.22.13","3.22.14","3.22.15","3.22.16","3.22.17","3.22.18","3.22.19","3.22.2","3.22.20","3.22.21","3.22.22","3.22.24","3.22.25","3.22.26","3.22.27","3.22.28","3.22.29","3.22.3","3.22.30","3.22.31","3.22.32","3.22.33","3.22.34","3.22.35","3.22.4","3.22.5","3.22.6","3.22.7","3.22.8","3.22.9","3.23.0","3.23.1","3.23.10","3.23.11","3.23.12","3.23.13","3.23.14","3.23.15","3.23.16","3.23.17","3.23.18","3.23.19","3.23.2","3.23.20","3.23.21","3.23.22","3.23.23","3.23.24","3.23.3","3.23.4","3.23.5","3.23.6","3.23.7","3.23.8","3.23.9","3.24.0","3.24.1","3.25.0","3.25.1","3.26.0","3.26.1","3.26.2","3.27.0","3.27.1","3.27.2","3.28.0","3.28.1","3.28.10","3.28.11","3.28.12","3.28.13","3.28.14","3.28.15","3.28.16","3.28.17","3.28.18","3.28.19","3.28.2","3.28.20","3.28.21","3.28.22","3.28.23","3.28.24","3.28.25","3.28.26","3.28.27","3.28.28","3.28.29","3.28.3","3.28.30","3.28.31","3.28.32","3.28.33","3.28.34","3.28.35","3.28.36","3.28.37","3.28.38","3.28.39","3.28.4","3.28.40","3.28.41","3.28.42","3.28.43","3.28.44","3.28.5","3.28.6","3.28.7","3.28.8","3.28.9","3.29.0","3.29.1","3.29.2","3.29.3","3.29.4","3.29.5","3.29.6","3.29.7","3.29.8","3.3.0","3.3.1","3.30.0","3.31.0","3.32.0","3.32.1","3.33.0","3.34.0","3.35.0","3.36.0","3.37.0","3.38.0","3.38.1","3.39.0","3.39.1","3.39.10","3.39.11","3.39.12","3.39.13","3.39.14","3.39.15","3.39.16","3.39.17","3.39.18","3.39.19","3.39.2","3.39.20","3.39.21","3.39.22","3.39.23","3.39.24","3.39.25","3.39.26","3.39.27","3.39.28","3.39.29","3.39.3","3.39.30","3.39.31","3.39.32","3.39.33","3.39.34","3.39.35","3.39.4","3.39.5","3.39.6","3.39.7","3.39.8","3.39.9","3.4.0","3.4.1","3.40.0","3.40.1","3.40.2","3.40.3","3.40.4","3.41.0","3.41.1","3.42.0","3.43.0","3.43.1","3.43.2","3.43.3","3.44.0","3.44.1","3.45.0","3.45.1","3.45.2","3.45.3","3.45.4","3.46.0","3.47.0","3.48.0","3.49.0","3.49.1","3.49.10","3.49.11","3.49.12","3.49.13","3.49.14","3.49.15","3.49.16","3.49.17","3.49.18","3.49.19","3.49.2","3.49.20","3.49.21","3.49.22","3.49.23","3.49.24","3.49.25","3.49.26","3.49.27","3.49.28","3.49.29","3.49.3","3.49.30","3.49.31","3.49.32","3.49.33","3.49.34","3.49.35","3.49.36","3.49.37","3.49.38","3.49.39","3.49.4","3.49.40","3.49.41","3.49.42","3.49.43","3.49.44","3.49.45","3.49.46","3.49.47","3.49.48","3.49.49","3.49.5","3.49.50","3.49.51","3.49.52","3.49.53","3.49.54","3.49.55","3.49.56","3.49.57","3.49.58","3.49.59","3.49.6","3.49.60","3.49.61","3.49.62","3.49.63","3.49.64","3.49.65","3.49.66","3.49.67","3.49.68","3.49.69","3.49.7","3.49.70","3.49.8","3.49.9","3.5.0","3.50.0","3.50.1","3.50.2","3.50.3","3.51.0","3.51.1","3.51.2","3.51.3","3.52.0","3.53.0","3.53.1","3.54.0","3.54.1","3.55.0","3.55.1","3.55.2","3.55.3","3.56.0","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5.post1","3.6.5.post2","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.5.post0","3.7.6","3.7.7","3.7.8","3.7.9","3.8.0","3.8.1","3.9.0","3.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.56.0"}]}],"versions":["3.0.0","3.0.0b1","3.0.0b10","3.0.0b11","3.0.0b12","3.0.0b13","3.0.0b14","3.0.0b15","3.0.0b16","3.0.0b17","3.0.0b18","3.0.0b19","3.0.0b2","3.0.0b20","3.0.0b21","3.0.0b22","3.0.0b23","3.0.0b3","3.0.0b4","3.0.0b5","3.0.0b6","3.0.0b7","3.0.0b8","3.0.0b9","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.0rc4","3.0.0rc5","3.0.0rc6","3.0.0rc7","3.0.0rc8","3.0.0rc9","3.0.1","3.1.0","3.1.1","3.10.0","3.11.0","3.11.0.post0","3.11.1","3.11.2","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.14.1","3.14.10","3.14.11","3.14.12","3.14.13","3.14.14","3.14.15","3.14.16","3.14.17","3.14.18","3.14.19","3.14.2","3.14.3","3.14.4","3.14.5","3.14.6","3.14.7","3.14.8","3.14.9","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.15.9","3.16.0","3.16.1","3.16.10","3.16.11","3.16.12","3.16.13","3.16.14","3.16.15","3.16.16","3.16.17","3.16.18","3.16.19","3.16.2","3.16.20","3.16.21","3.16.22","3.16.23","3.16.24","3.16.3","3.16.4","3.16.5","3.16.6","3.16.7","3.16.8","3.16.9","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.1","3.18.10","3.18.11","3.18.12","3.18.13","3.18.14","3.18.15","3.18.16","3.18.17","3.18.18","3.18.19","3.18.2","3.18.20","3.18.21","3.18.22","3.18.23","3.18.24","3.18.25","3.18.26","3.18.27","3.18.28","3.18.29","3.18.3","3.18.30","3.18.31","3.18.32","3.18.33","3.18.34","3.18.35","3.18.4","3.18.5","3.18.6","3.18.7","3.18.8","3.18.9","3.19.0","3.19.1","3.2.0","3.2.1","3.20.0","3.21.0","3.21.1","3.21.10","3.21.11","3.21.12","3.21.13","3.21.14","3.21.15","3.21.16","3.21.17","3.21.18","3.21.19","3.21.2","3.21.20","3.21.21","3.21.22","3.21.23","3.21.24","3.21.25","3.21.26","3.21.29","3.21.3","3.21.30","3.21.31","3.21.32","3.21.33","3.21.34","3.21.35","3.21.36","3.21.4","3.21.5","3.21.6","3.21.7","3.21.8","3.21.9","3.22.0","3.22.1","3.22.10","3.22.11","3.22.12","3.22.13","3.22.14","3.22.15","3.22.16","3.22.17","3.22.18","3.22.19","3.22.2","3.22.20","3.22.21","3.22.22","3.22.24","3.22.25","3.22.26","3.22.27","3.22.28","3.22.29","3.22.3","3.22.30","3.22.31","3.22.32","3.22.33","3.22.34","3.22.35","3.22.4","3.22.5","3.22.6","3.22.7","3.22.8","3.22.9","3.23.0","3.23.1","3.23.10","3.23.11","3.23.12","3.23.13","3.23.14","3.23.15","3.23.16","3.23.17","3.23.18","3.23.19","3.23.2","3.23.20","3.23.21","3.23.22","3.23.23","3.23.24","3.23.3","3.23.4","3.23.5","3.23.6","3.23.7","3.23.8","3.23.9","3.24.0","3.24.1","3.25.0","3.25.1","3.26.0","3.26.1","3.26.2","3.27.0","3.27.1","3.27.2","3.28.0","3.28.1","3.28.10","3.28.11","3.28.12","3.28.13","3.28.14","3.28.15","3.28.16","3.28.17","3.28.18","3.28.19","3.28.2","3.28.20","3.28.21","3.28.22","3.28.23","3.28.24","3.28.25","3.28.26","3.28.27","3.28.28","3.28.29","3.28.3","3.28.30","3.28.31","3.28.32","3.28.33","3.28.34","3.28.35","3.28.36","3.28.37","3.28.38","3.28.39","3.28.4","3.28.40","3.28.41","3.28.42","3.28.43","3.28.44","3.28.5","3.28.6","3.28.7","3.28.8","3.28.9","3.29.0","3.29.1","3.29.2","3.29.3","3.29.4","3.29.5","3.29.6","3.29.7","3.29.8","3.3.0","3.3.1","3.30.0","3.31.0","3.32.0","3.32.1","3.33.0","3.34.0","3.35.0","3.36.0","3.37.0","3.38.0","3.38.1","3.39.0","3.39.1","3.39.10","3.39.11","3.39.12","3.39.13","3.39.14","3.39.15","3.39.16","3.39.17","3.39.18","3.39.19","3.39.2","3.39.20","3.39.21","3.39.22","3.39.23","3.39.24","3.39.25","3.39.26","3.39.27","3.39.28","3.39.29","3.39.3","3.39.30","3.39.31","3.39.32","3.39.33","3.39.34","3.39.35","3.39.4","3.39.5","3.39.6","3.39.7","3.39.8","3.39.9","3.4.0","3.4.1","3.40.0","3.40.1","3.40.2","3.40.3","3.40.4","3.41.0","3.41.1","3.42.0","3.43.0","3.43.1","3.43.2","3.43.3","3.44.0","3.44.1","3.45.0","3.45.1","3.45.2","3.45.3","3.45.4","3.46.0","3.47.0","3.48.0","3.49.0","3.49.1","3.49.10","3.49.11","3.49.12","3.49.13","3.49.14","3.49.15","3.49.16","3.49.17","3.49.18","3.49.19","3.49.2","3.49.20","3.49.21","3.49.22","3.49.23","3.49.24","3.49.25","3.49.26","3.49.27","3.49.28","3.49.29","3.49.3","3.49.30","3.49.31","3.49.32","3.49.33","3.49.34","3.49.35","3.49.36","3.49.37","3.49.38","3.49.39","3.49.4","3.49.40","3.49.41","3.49.42","3.49.43","3.49.44","3.49.45","3.49.46","3.49.47","3.49.48","3.49.49","3.49.5","3.49.50","3.49.51","3.49.52","3.49.53","3.49.54","3.49.55","3.49.56","3.49.57","3.49.58","3.49.59","3.49.6","3.49.60","3.49.61","3.49.62","3.49.63","3.49.64","3.49.65","3.49.66","3.49.67","3.49.68","3.49.7","3.49.8","3.49.9","3.5.0","3.50.0","3.50.1","3.50.2","3.50.3","3.51.0","3.51.1","3.51.2","3.51.3","3.52.0","3.53.0","3.53.1","3.54.0","3.54.1","3.55.0","3.55.1","3.55.2","3.55.3","3.56.0","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5.post1","3.6.5.post2","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.5.post0","3.7.6","3.7.7","3.7.8","3.7.9","3.8.0","3.8.1","3.9.0","3.9.1"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.16-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.32-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.16-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.32-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.11-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.16-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.32-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.16-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.32-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.20-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.1.el9ap"}]}],"bundled":4}],"products":[{"vendor":"pulpproject","product":"pulp"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat update infrastructure 4 for cloud providers"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:6765","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7143","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2300125","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/advisories/GHSA-9m5j-4xx9-44j9","tags":["advisory"]},{"url":"https://github.com/pulp/pulpcore/blob/93f241f34c503da0fbac94bdba739feda2636e12/pulpcore/tasking/_util.py#L108","tags":["Issue Tracking","web","article"]},{"url":"https://github.com/pulp/pulpcore/blob/main/CHANGES.md","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7143","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7143.json","tags":["advisory"]},{"url":"https://github.com/pulp/pulpcore","tags":["package"]},{"url":"https://pypi.org/project/pulpcore","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292788","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6765.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7143","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24788","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2824","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24790","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24790","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-37891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-7143","title":"Pulpcore: rbac permissions incorrectly assigned in tasks that create objects","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","status":"published","published":"2024-08-07T16:49:29.842Z","modified":"2026-06-02T15:17:14.856Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-277"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-2549","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","status":"published","published":"2024-08-07T16:49:29Z","modified":"2026-06-02T15:17:14Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:56.053165Z"}],"ghsa":[{"id":"GHSA-9m5j-4xx9-44j9","title":"Pulp incorrectly assigns RBAC permissions in tasks that create objects","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","status":"published","published":"2024-08-07T18:30:44Z","modified":"2026-03-20T21:18:11Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-277"],"updated_at":"2026-11-02T14:39:39.567266Z"}],"nvd":[{"id":"CVE-2024-7143","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","status":"published","published":"2024-08-07T17:15:52.337Z","modified":"2026-06-17T08:19:26.32Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"},{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-277"],"updated_at":"2026-11-02T14:10:17.832118Z"}],"osv":[{"id":"CVE-2024-7143","title":"Pulpcore: rbac permissions incorrectly assigned in tasks that create objects","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","status":"published","published":"2024-08-07T16:49:29.842Z","modified":"2026-10-28T02:30:59.389623188Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-277"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"GHSA-9m5j-4xx9-44j9","title":"Pulp incorrectly assigns RBAC permissions in tasks that create objects","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","status":"published","published":"2024-08-07T18:30:44Z","modified":"2026-09-10T03:50:17.493456865Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-277"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"PYSEC-2026-1808","title":"Pulp incorrectly assigns RBAC permissions in tasks that create objects","description":"A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.","status":"published","published":"2026-07-07T14:34:38.535044Z","modified":"2026-07-29T16:01:15.260233517Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"RHSA-2024:6765","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-10-02T11:06:30Z","modified":"2026-10-16T10:05:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"}]}}