The CONSUMER_GROUP_DESCRIBE API in Apache Kafka incorrectly validates the DESCRIBE operation on the GROUP resource rather than the documented READ operation. This mismatch can grant users read permission to group metadata or allow users with DESCRIBE permission to access sensitive group information even if they lack READ rights. The flaw is an authorization bypass (CWE‑285) that could expose internal group details to unauthorized parties.

All installations of Apache Kafka that expose the CONSUMER_GROUP_DESCRIBE API are vulnerable, regardless of version, because the issue lies in the API’s permission validation logic. No specific version range is provided, so administrators should evaluate all Kafka clusters that use this API.

The vulnerability is an authorization lapse; exploitation requires an authenticated Kafka client that can invoke the CONSUMER_GROUP_DESCRIBE request. Because no EPSS score is available and the issue is not listed in CISA's KEV catalog, the current exploitation likelihood appears low but still actionable. The vendor has noted that the API’s permission check is correct but documentation will be updated. Attackers could harvest group metadata, potentially revealing consumer group configurations and usage patterns.