EUVD-2026-50237
GHSA-w667-wgvw-q2hc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible REST API (AV:N, AC:L); requires any valid authentication (PR:L); admin operations enable full data modification and potential service disruption (C:H/I:H/A:H).
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Missing authorization on admin REST endpoints in Apache Atlas 0.8.0 through 2.5.0 allows any authenticated user - regardless of assigned role - to perform privileged administrative operations that should be restricted to administrators. The flaw spans 15 release versions across a multi-year window, affecting all standard deployments of the atlas-webapp component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in Apache Atlas - any user account is sufficient regardless of assigned role, meaning even read-only or data steward accounts can be used. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector or EPSS score was provided, so risk metrics must be inferred from the description and vulnerability class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid but low-privileged Apache Atlas account - for example, a data analyst account or a compromised service account used by an ETL pipeline - sends HTTP requests directly to Atlas admin REST endpoints. Because the authorization layer does not verify the caller's role, the server accepts and executes the request, granting the attacker the ability to modify type definitions, purge metadata entities, or alter audit configurations. … |
| Remediation | Upgrade to Apache Atlas 2.6.0, which the Apache Atlas project confirms resolves the missing authorization checks on admin endpoints; this is the primary and recommended remediation per the vendor advisory at https://atlas.apache.org/ and the oss-security notice at https://seclists.org/oss-sec/2026/q3/316. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Apache Atlas deployments and document current versions; pull authentication logs for the past 90 days to identify credential usage patterns and anomalies in admin endpoint access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today