CVE-2023-31453: Apache InLong: IDOR make users can delete others' subscription

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-22 · updated 2026-06-17
Weakness: CWE-732

Description

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949

Affected products

Apache Software Foundation Apache InLong: from 1.2.0 through 1.6.0

References

https://lists.apache.org/thread/9nz8o2skgc5230w276h4w92j0zstnl06
https://lists.apache.org/thread/9nz8o2skgc5230w276h4w92j0zstnl06

Get alerted when CVE-2023-31453 or the next vulnerability affects your stack