Description (CNA)
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache Airflow | affected unspecified through 2.4.0 |
CWE
CWE-613
References
- https://github.com/apache/airflow/pull/26635
- https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y
ADP enrichment
No English description supplied.