The vulnerability arises because the transaction administration REST API in Apache Pulsar does not enforce tenant validation on its read endpoints, allowing any authenticated user—regardless of permissions—to retrieve transaction data belonging to other tenants. This is a case of missing authorization (CWE‑862). The exposed information includes transaction coordinator addresses, statistics, metadata such as topic and subscription names, the principal that initiated each transaction, and internal buffer and acknowledgment metrics. No message payloads, configuration changes, or transaction abort capabilities are exposed, but the leakage of these details permits serious privacy violations.

Apache Pulsar is impacted for versions starting with 2.8.0 up to (but not including) 4.0.14, and for 4.1.0 up to (but not including) 4.2.5. The affected releases can be summarized as Apache Pulsar 2.8.0–4.0.13 and 4.1.0–4.2.4. The supported release lines 4.0.x and 5.0.x include the patched revisions; administrators using older 2.x or unsuperseded 4.x branches should upgrade accordingly.

The CVSS score of 2.3 indicates modest severity, and the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector is straightforward: any authenticated user—even those without specific tenant permissions—can trigger the vulnerable API if transaction support is enabled (transactionCoordinatorEnabled=true, which is off by default). Therefore, environments that expose the admin HTTP interface or have weak authentication are theoretically vulnerable. While the risk level is low in terms of impact magnitude, the possibility of sensitive cross‑tenant data exposure makes regular patching or mitigation essential.