CVE-2026-63040

CVE-2026-63040: Apache InLong: Missing authorization in StreamSource forceDelete

Vendor Apache Software Foundation

Product Apache InLong

Weakness CWE-552 · Files accessible externally

Published August 20, 2026

Last update August 20, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12145 .

Key dates

02Disclosure timeline

August 20, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-63040 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/552.html AskarLabs — CWE-552 write-up Files or Directories Accessible to External Parties

Related vulnerabilities

04Related CVE

CVE-2022-2222 Download Monitor < 4.5.91 - Admin+ Arbitrary File Download CVE-2025-12894 Import WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure CVE-2022-1585 Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download CVE-2025-12648 WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files