StreamSource in Apache InLong performs no authorization check when a deletion request is made. The flaw allows any authenticated user to logically delete every stream source, potentially wiping critical data and disrupting services. This results in loss of data integrity and availability, and can lead to broader operational impacts if the deleted streams were part of production pipelines.

The vulnerability affects Apache InLong versions 2.0.0 through 2.3.x. Users running any of these releases are impacted until they move to version 2.4.0 or greater.

The CVSS score for this issue is not publicly disclosed, and no EPSS score is available. Consequently, the exact numerical risk assessment is unavailable. The flaw is confirmed as a vendor‑reported missing authorization, and no known exploit has been documented in the CISA KEV catalog. Inferred from the description, an attacker would need valid authentication to any InLong installation with the affected versions, after which they could invoke the deletion operation. Given the absence of a public exploit, the likelihood of exploitation remains uncertain, but the potential impact is significant.