A flaw in Apache Kylin’s backend metadata dump API allows a request to the endpoint to bypass both authorization checks and path confinement. This means an unauthenticated or insufficiently privileged user can retrieve raw system metadata files that are normally protected. The resulting exposure could reveal configuration details, internal directory structures, and other sensitive information that may be leveraged for further attacks. The weakness is formally classified as CWE-862: Missing Authorization, indicating that the software fails to enforce correct access control over resources.

The vulnerability applies to versions 4 through 5.0.4 of Apache Kylin, distributed by the Apache Software Foundation. Users of these releases, especially those that expose the Kylin service to untrusted networks, are at risk. Deployments behind strict internal firewalls or those that are not publicly reachable are typically unaffected.

The CVSS score of 9.1 denotes a high‑severity flaw. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a low probability of widespread exploitation at present. However, if an environment exposes the meta dump endpoint to the public Internet, attackers can remotely exploit this vulnerability via a crafted HTTP request. Successful exploitation yields confidential metadata that could be used to plan targeted attacks or to enumerate the system’s layout.