CVE-2026-62393

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects.

This issue affects Apache Kylin: from 4 through 5.0.3.

Users are recommended to upgrade to version 5.0.4, which fixes the issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-280

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Kylin	>= 4, <= 5.0.3

References

https://lists.apache.org/thread/xg8dcyjw0nkq5y8dhq3r25x3rxc62x9jMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/14/6Mailing List, Third Party Advisory

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-62406.8A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks w CVE-2026-62416.8An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly CVE-2026-624149.1Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly CVE-2026-624159.1Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior vers CVE-2026-624165.3Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication CVE-2026-624188.1Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This CVE-2026-62426.8An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally CVE-2026-624209.9An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-pr CVE-2026-624229.8In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass v CVE-2026-624235.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The direct CVE-2026-624245.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The direct CVE-2026-624255.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The direct