The vulnerability allows an unauthorized user to discard jobs from any project in Apache Kylin. By calling the job‑discard API endpoint, the attacker can delete or cancel data‑processing tasks that belong to other projects, resulting in loss of work and disruption of analytical workflows. This abuse of the job control API represents an availability impact on affected projects.

Apache Kylin versions 4.x through 5.0.4 are affected. The Apache Software Foundation released version 5.0.5 with the fix, so only installations running those earlier releases are vulnerable.

The EPSS score of 0.00431 (0.431%) indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score is 7.5. However, because the flaw permits cross‑project job deletion, an attacker who can reach the Kylin REST API can exploit it. The likely attack vector is remote, requiring network access to the Kylin services and authentication to the service; the exact prerequisite authentication level is not detailed in the provided information.