CVE-2026-63040 — Apache InLong: Missing authorization in StreamSource forceDelete

Description (CNA)

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12145 .

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache InLong	affected 2.0.0 before 2.4.0

CWE

CWE-552

References

https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offy

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/08/20/14

CISA-ADP

No English description supplied.

No references supplied.