Critical · published May 22, 2023
🚨 Different users in Apache InLong can delete or edit each other's sources — it's a wild free-for-all in the file cabinet! 🔥 Imagine a shared office where anyone can walk in and throw out important documents or change the contents of others' files without permission — chaos, right? That's exactly what's happening here with InLong versions 1.4.0 to 1.6.0! An attacker could maliciously modify or delete another user's sources, potentially leading to data loss, service disruption, or unauthorized changes. This lack of segregation turns teamwork into turmoil and could seriously compromise your operations!
Imagine a shared office where anyone can walk in and throw out important documents or change the contents of others' files without permission — chaos, right? That's exactly what's happening here with InLong versions 1.4.0 to 1.6.0! This vulnerability arises from insufficient access controls, allowing users to manage others' sources in Apache InLong recklessly, from deletion to editing, without proper restrictions in place.
An attacker could maliciously modify or delete another user's sources, potentially leading to data loss, service disruption, or unauthorized changes. This lack of segregation turns teamwork into turmoil and could seriously compromise your operations! Upgrade to Apache InLong 1.7.0 immediately to close this gaping hole. If you can't upgrade right away, cherry-pick the fix from the pull request here: https://github.com/apache/inlong/pull/7775. Don't skip this; protecting your data integrity is a must! You’ve got this! Follow these steps and you’ll have your InLong environment secured in no time. 🛡️