A flaw was found in automation-controller (AWX). In
awx/api/serializers.py, BulkJobLaunchSerializer.validate() authorizes the
instance_groups many-to-many field via check_list_permission(InstanceGroup,
...) with no action argument, which the helper interprets as a read-level
check (user.get_queryset(model)). The equivalent single-job launch path
(awx/main/access.py, JobLaunchConfigAccess.can_add) checks the same field at
use level (use_instancegroup / use_role) and raises HTTP 403 on failure. The
bulk view enforces only IsAuthenticated, so the under-scoped serializer check
is the sole authorization for instance-group placement. Because
user.get_queryset(InstanceGroup) returns all instance groups for a System
Auditor (and any read-visible group for other users), a caller with execute
on a job template and read (not use) on an instance group can POST to
/api/v2/bulk/job_launch/ and have the job actually placed on that group,
bypassing execution-placement isolation. The maintainers' own inline comments
("# TODO: change to use_role for conflict" and "duplicated with
BulkJobLaunchSerializer, check when changing permission levels") mark the gap.
Inventory and Credential fields on the same bulk path are correctly checked
at use level; instance_groups is the outlier.
    Upstream: github.com/ansible/awx (serializers.py BulkJobLaunchSerializer)
    Present at: tag 24.6.1 (commit 94e5795) and devel HEAD