In mlflow versions up to 3.9.0 the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack per-model authorization checks when basic authentication is enabled. This omission allows any authenticated user to enumerate all model versions and metadata—including names, version descriptions, source URIs, tags, and other properties—across all registered models. The weakness is a combination of CWE-284 Authorization Bypass and CWE-639 Authorization Bypass.

The affected product is the mlflow project (mlflow:mlflow/mlflow). All releases up to and including 3.9.0 are vulnerable; the issue was fixed in version 3.10.0 and later.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed active exploitation yet. The likely attack vector involves an authenticated remote user exploiting the web service; such a user can retrieve sensitive metadata across all models, potentially exposing proprietary or confidential information in a multi-tenant environment.