An Uncontrolled Resource Consumption flaw in Apache InLong allows users who do not hold the responsibility for a template to access its details, potentially exposing sensitive configuration data and providing insight into the system. The defect permits these users to retrieve template information, raising the risk of non‑authorized information disclosure and aiding attackers in mapping the application. This weakness falls under CWE‑400, indicating that inappropriate enforcement of resource constraints leads to unintended access.

Apache InLong versions 2.0.0 through 2.3.x are vulnerable. The change set introduced in version 2.4.0 and later removes this capability by tightening role checks.

The CVSS score of 4.3 suggests a moderate severity, reflecting an impact limited to information disclosure and a modest increase in potential resource consumption. EPSS data is not available, so the exploitation likelihood is uncertain, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to authenticate or otherwise engage the InLong service over the network; the attack vector is likely remote, but the primary consequence remains confidentiality exposure.