Cube‑studio up to version 2026.09.01 contains a missing authorization check in the file myapp/views/view_pipeline.py. This flaw allows any authenticated user to request pipelines from other project groups by specifying the pipeline id. By enumerating sequential ids through the exposed web endpoints—view_pipeline, log, monitoring, pod, and copy_pipeline—an attacker can expose internal metadata such as the directed‑acyclic‑graph configurations, cluster names, namespaces, Argo workflow identifiers, and pod names, or even clone entire pipelines without permission.

The affected product is Cube‑studio from data‑infra. All installations running version 2026.09.01 or earlier are vulnerable. No specific patch version is listed in the advisory, but any release that includes the missing authorization fix will resolve the issue.

The CVSS score of 5.3 classifies the vulnerability as moderate. EPSS data is not provided, so the likelihood of exploitation is currently unknown. The vulnerability is not in the CISA KEV catalog. The primary attack vector is through the web interface; attackers must be authenticated but can use the exposed endpoints to enumerate pipeline identifiers and harvest sensitive environment data, which could be leveraged for further compromise if additional privileges are available.