Apache HBase’s thrift and REST delegation service allows a client to open a scanner that returns a unique identifier. The subsequent fetch and close operations lack an owner check, permitting an authenticated user to query or close scanners that were created by other users. The result is unauthorized reading of data and premature termination of other users’ scanners, which can lead to data leakage and disruption of legitimate scanning sessions. This flaw maps to CWE-862, reflecting missing access control.

Apache HBase released from 3.0.0‑alpha‑1 through 3.0.0‑beta‑1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, and across all 2.4.* releases is impacted.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the thrift or REST endpoints and valid credentials; the flaw is a remote authorization bypass that can be leveraged to read or close arbitrary scanners.