CVE-2026-62393

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62393", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-14T03:33:13.944Z", "datePublished": "2026-07-14T12:19:27.705Z", "dateUpdated": "2026-07-15T15:13:25.772Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Kylin", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "5.0.3", "status": "affected", "version": "4", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Yicheng <yyc2569580673@gmail.com>"}, {"lang": "en", "type": "finder", "value": "Haoran Zhao"}, {"lang": "en", "type": "finder", "value": "Lei Zhang"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin.&nbsp;Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects.</p><p>This issue affects Apache Kylin: from 4 through 5.0.3.</p><p>Users are recommended to upgrade to version 5.0.4, which fixes the issue.</p>"}], "value": "Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin.\u00a0Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects.\n\nThis issue affects Apache Kylin: from 4 through 5.0.3.\n\nUsers are recommended to upgrade to version 5.0.4, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-14T12:19:27.705Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/xg8dcyjw0nkq5y8dhq3r25x3rxc62x9j"}], "source": {"defect": ["KYLIN-6090"], "discovery": "UNKNOWN"}, "title": "Apache Kylin: Improper authorization in job information retrieval", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/14/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-14T12:31:59.175Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T13:56:22.738167Z", "id": "CVE-2026-62393", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T15:13:25.772Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/14/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-14T12:31:59.175Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-62393", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T13:56:22.738167Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T13:56:44.183Z"}}], "cna": {"title": "Apache Kylin: Improper authorization in job information retrieval", "source": {"defect": ["KYLIN-6090"], "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Yicheng <yyc2569580673@gmail.com>"}, {"lang": "en", "type": "finder", "value": "Haoran Zhao"}, {"lang": "en", "type": "finder", "value": "Lei Zhang"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kylin", "versions": [{"status": "affected", "version": "4", "versionType": "semver", "lessThanOrEqual": "5.0.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/xg8dcyjw0nkq5y8dhq3r25x3rxc62x9j", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin.\u00a0Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects.\n\nThis issue affects Apache Kylin: from 4 through 5.0.3.\n\nUsers are recommended to upgrade to version 5.0.4, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin.&nbsp;Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects.</p><p>This issue affects Apache Kylin: from 4 through 5.0.3.</p><p>Users are recommended to upgrade to version 5.0.4, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-14T12:19:27.705Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62393", "state": "PUBLISHED", "dateUpdated": "2026-07-15T15:13:25.772Z", "dateReserved": "2026-07-14T03:33:13.944Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-07-14T12:19:27.705Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Kylin", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "5.0.3", "status": "affected", "version": "4", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*", "matchCriteriaId": "D231A8C1-6E4E-4BB6-8581-74B9A44868B0", "versionEndExcluding": "5.0.4", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin.\u00a0Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects.\n\nThis issue affects Apache Kylin: from 4 through 5.0.3.\n\nUsers are recommended to upgrade to version 5.0.4, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de Manejo Inadecuado de Permisos o Privilegios Insuficientes en Apache Kylin. Autorizaci\u00f3n inadecuada en la recuperaci\u00f3n de informaci\u00f3n de trabajos, donde un atacante puede obtener acceso a trabajos no autorizados en otros proyectos.\n\nEste problema afecta a Apache Kylin: desde la versi\u00f3n 4 hasta la 5.0.3.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 5.0.4, que corrige el problema."}], "id": "CVE-2026-62393", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62393", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T13:56:22.738167Z", "version": "2.0.3"}}]}, "published": "2026-07-14T13:19:08.663", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/xg8dcyjw0nkq5y8dhq3r25x3rxc62x9j"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/14/6"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-280"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4,5.0.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Kylin", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kylin", "vendor": "apache"}], "created": "2026-07-14T13:30:03.966679+00:00", "updated": "2026-08-13T13:00:04.984627+00:00", "vendors": ["apache", "apache$PRODUCT$kylin"]}