CVE-2026-75109CWE-862broken-access-control

CVE-2026-75109

High · published August 18, 2026

CVSS v3.1

7.1

EPSS

Percentile

20.9

In the wild

Unconfirmed

What it is

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0: 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00295 · 20.9th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-18T01:16Z

References (5)

https://github.com/determined-ai/determined · [email protected]https://github.com/determined-ai/determined/blob/main/master/internal/api_generic_tasks.go · [email protected]https://github.com/determined-ai/determined/issues/10270 · [email protected]https://www.vulncheck.com/advisories/determined-missing-authorization-check-on-generic-task-endpoints · [email protected]https://github.com/determined-ai/determined/issues/10270 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 AUG 20:36Z
Determined Missing Authorization Check on Generic Task Endpoints
cvelistv5