EUVD-2026-77516
GHSA-mwq3-c685-c87r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable service with low complexity; PR:L because servlet filter authentication is required; C:L for partial log content disclosure with no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Authorization bypass in Apache Storm Logviewer 3.0.0 exposes daemon logs and tenant log file listings to any filter-authenticated user, entirely disregarding the configured logs.users and logs.groups access controls. A boolean short-circuit in the daemon log authorization path discards the authorizer's decision whenever the daemon-log flag is set, and the daemon log page and download endpoints are reached without consulting an authorizer at all; additionally, the listing endpoints /listLogs and /searchLogs accept a user argument but never apply it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to reach the Logviewer HTTP service over the network and must successfully pass the configured servlet filter - possession of valid credentials or a session token accepted by the filter is required; this bug does not grant unauthenticated access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was assigned by the reporter; the advisory rates severity as 'moderate,' which is consistent with independent assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade org.apache.storm:storm-webapp to version 3.1.0, in which the daemon log page and download paths evaluate the same configured `logs.users` and `logs.groups` allowlists already applied to worker log paths, and the listing endpoints (`/listLogs`, `/searchLogs`) filter results by the requesting user's identity. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Storm clusters running Logviewer 3.0.0 and assess which serve multi-tenant workloads; implement temporary network-level access restrictions to the Logviewer endpoints (typically port 8000) using firewall rules or WAF policies to limit exposure to authorized administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today