EUVD-2026-60388
GHSA-62vf-9v93-9rf4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API reachable (AV:N), no special conditions (AC:L), requires valid account (PR:L); integrity low (task state change), availability high (task termination).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.
AnalysisAI
Missing authorization on Determined's generic task management API endpoints allows any authenticated user to kill, pause, or unpause tasks belonging to other users. The flaw - rooted in CWE-862 (Missing Authorization) - means a low-privileged user with a valid account can disrupt any other user's ML training workloads across the platform without owning those tasks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the Determined platform (PR:L per CVSS vector) - unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H) scores 7.1 and accurately reflects the threat model: network-reachable, trivially exploitable by any authenticated user, with high availability impact (task termination) and low integrity impact (task state manipulation). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privilege user on a shared Determined cluster enumerates task IDs visible via the platform's task listing endpoints, then issues kill or pause API calls against tasks owned by other users - such as a competing team's long-running GPU training job. No public exploit code exists at time of analysis, but the attack requires only a valid session token and knowledge of a target task ID, both readily obtainable within a shared deployment. |
| Remediation | No vendor-released patched version has been independently confirmed from the available references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Determined deployments and audit the scope of authenticated users with API access to task management endpoints; catalog business-critical training pipelines that could be disrupted. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today