A flaw was found in the Ansible Automation Platform Controller.
    The CopyAPIView.post() method does not verify that the
    requesting user has read access to the source object before
    performing the copy operation, while the corresponding GET
    handler does enforce this check. A user with Use roles on a
    shared project and inventory can copy any Job Template built
    on those resources — including Job Templates they cannot read
    — and become Admin of the clone. The clone contains the source
    Job Template's plaintext host_config_key and extra_vars fields,
    which frequently contain secrets. The recovered host_config_key
    can be used to authenticate against the original Job Template's
    provisioning callback endpoint.