{"api_version":"1","generated_at":"2026-11-11T13:51:01+00:00","cve":"CVE-2026-124496","urls":{"html":"https://cve.report/CVE-2026-124496","api":"https://cve.report/api/cve/CVE-2026-124496.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-124496","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-124496"},"summary":{"title":"Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer","description":"The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-11 13:17:19","updated_at":"2026-11-11 13:17:19"},"problem_types":["CWE-863","CWE-863 CWE-863 Incorrect Authorization"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr","name":"https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-124496","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124496","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Storm","version":"affected 3.0.0 3.2.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Javier García Herrera","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-server","packageURL":"pkg:maven/org.apache.storm/storm-server","product":"Apache Storm","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Javier García Herrera"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"value":"The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T12:35:22.344Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr"}],"source":{"discovery":"EXTERNAL"},"title":"Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-124496","datePublished":"2026-11-11T12:35:22.344Z","dateReserved":"2026-11-08T05:21:23.284Z","dateUpdated":"2026-11-11T12:35:22.344Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-11 13:17:19","lastModifiedDate":"2026-11-11 13:17:19","problem_types":["CWE-863","CWE-863 CWE-863 Incorrect Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"124496","Ordinal":"1","Title":"Apache Storm: DRPC HTTP doAsUser bypasses the impersonation auth","CVE":"CVE-2026-124496","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"124496","Ordinal":"1","NoteData":"The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.","Type":"Description","Title":"Apache Storm: DRPC HTTP doAsUser bypasses the impersonation auth"}]}}}