CVE-2026-93737CWE-862broken-access-control

CVE-2026-93737

Medium · published September 18, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-18T20:17Z
References (6)
https://github.com/azkaban/azkaban · [email protected]https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L237-L262 · [email protected]https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L403-L412 · [email protected]https://github.com/azkaban/azkaban/issues/3348 · [email protected]https://github.com/azkaban/azkaban/releases/tag/4.0.0 · [email protected]https://www.vulncheck.com/advisories/azkaban-through-4.0.0-authorization-bypass-via-scheduleservlet · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 16:04Z
    Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
    cvelistv5