Apache InLong CVE-2026-63015

Exploitation requires a valid authenticated session in Apache InLong - the attacker must be a logged-in user of the platform but specifically one who is NOT assigned as a 'template responsible person' for the targeted template. The authorization bypass occurs at the template visibility layer. Limiting factors: requires authenticated access (PR:L or higher), affects only environments running Apache InLong 2.0.0 through 2.3.x, and is limited to reading template information rather than modifying it (based on description). If a separate resource exhaustion path exists per CWE-400, conditions for that path are unknown from available data - verify with vendor advisory.

No CVSS vector or score has been published by NVD or the reporter, making quantitative risk comparison impossible from available data. EPSS data is absent. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, so active exploitation is not confirmed. The description implies a low-privilege, network-accessible path to read restricted template information, which would suggest a moderate-to-low confidentiality impact in isolation. However, the CWE-400/DoS tags introduce unresolved ambiguity: if resource exhaustion is also present, availability impact must be evaluated separately. The mismatch between the DoS classification and the information-disclosure description is a significant data quality concern - the actual exploitable attack surface may be broader or narrower than either characterization alone suggests. Defenders should treat this primarily as an access control issue with uncertain availability impact until the vendor or NVD publishes a CVSS vector.

An authenticated InLong user who lacks the 'template responsible person' role accesses the template management endpoint directly, bypassing the intended authorization check to read template configurations belonging to other data stream owners. Because no public exploit has been identified, exploitation likely requires knowledge of the endpoint and a valid session, limiting opportunistic attacks. If the CWE-400 characterization is accurate in addition to the access control issue, a separate resource exhaustion path may also exist.