A missing authorization vulnerability was found in EDA (Event-Driven Ansible). The websocket endpoint at /api/eda/ws/ansible-rulebook does not verify that the authenticated user has permission to access the specified activation. The handle_workers() method in consumers.py performs a direct database lookup by activation_id without permission filtering. Any authenticated user, even with zero EDA permissions, can send a forged Worker message with any activation_id and receive plaintext credentials including AAP Controller OAuth tokens, vault passwords, SSH private keys, and TLS certificates.