Apache Oozie suffers from an improper input validation flaw that allows an authenticated user to reconfigure a workflow job belonging to another tenant and assign new ownership to that job. The vulnerability enables the attacker to override the intended per-job Access Control List, effectively gaining control over jobs not originally authorized for them. This can lead to unauthorized data access or modification in environments where job ownership determines permissions to underlying resources.

The flaw is present in all releases of Apache Oozie, which is an unmaintained, retired project. No patches or updates are being released, so any instance running Oozie remains vulnerable if it is not actively maintained or replaced.

Exploitation requires only standard authentication within the same Oozie instance, so an internal threat actor with legitimate credentials can trigger the flaw. The lack of an EPSS score and the absence from the CISA KEV catalog do not negate the risk, as control over job ownership can bypass tenant isolation. The realistic attack vector is internal user-to-user manipulation within a shared Oozie deployment, making the risk significant for multi-tenant environments that cannot enforce stricter isolation.