{"schema_version": "1.6.1", "id": "CVE-2026-63040", "summary": "Missing authorization in StreamSource forceDelete", "details": "Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12145 .", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "2.0.0"}, {"fixed": "2.4.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offy"}]}