Determined
Monthly
Missing authorization on Determined's generic task management API endpoints allows any authenticated user to kill, pause, or unpause tasks belonging to other users. The flaw - rooted in CWE-862 (Missing Authorization) - means a low-privileged user with a valid account can disrupt any other user's ML training workloads across the platform without owning those tasks. No public exploit code has been identified at time of analysis, but the attack surface is straightforward: any authenticated API call to the affected endpoints against an unprotected resource suffices.
Missing authorization on Determined's generic task management API endpoints allows any authenticated user to kill, pause, or unpause tasks belonging to other users. The flaw - rooted in CWE-862 (Missing Authorization) - means a low-privileged user with a valid account can disrupt any other user's ML training workloads across the platform without owning those tasks. No public exploit code has been identified at time of analysis, but the attack surface is straightforward: any authenticated API call to the affected endpoints against an unprotected resource suffices.