In mlflow versions up to 3.9.0 the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack per-model authorization checks when basic authentication is enabled. This omission allows any authenticated user to enumerate all model versions and metadata—including names, version descriptions, source URIs, tags, and other properties—across all registered models. The weakness is a combination of CWE-284 Authorization Bypass and CWE-639 Authorization Bypass.

The affected product is the mlflow project (mlflow:mlflow/mlflow). releases up to and including 3.9.0 are vulnerable; the issue was fixed in version 3.10.0 and later.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% shows a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector involves an authenticated remote user exploiting the web service; such a user can retrieve sensitive metadata across all models, potentially exposing proprietary or confidential information in a multi-tenant environment.