CVE-2026-50622
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Apache Atlas, missing authorization in admin endpoints allows any authenticated user, regardless of role, to perform administrative operations.
Risk Assessment
The organization is at risk of unauthorized configuration changes and system management by regular users, potentially compromising data integrity.
Recommendation
Upgrade Apache Atlas to version 2.6.0, which fixes the issue.
Other vulnerabilities in Apache Atlas
See all- CVE-2026-40563High
Apache Atlas has a code injection vulnerability that allows an attacker to alter Gremlin traversal logic by supplying malicious query strings. This can lead to unauthorized access to data.
- CVE-2017-3154High
Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
- CVE-2016-8752High
Apache Atlas versions 0.6.0, 0.7.0, and 0.7.1 allow access to the webapp directory contents by pointing to URIs like /js and /img.
- CVE-2025-62198Medium
An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier.
Original NVD description (English source)
Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through 2.5.0. Mitigation: Users are recommended to upgrade to version 2.6.0, which fixes the issue.