This vulnerability allows a user with access to Apache Kylin to manipulate jobs in projects to which they otherwise have no authority. By invoking the JobController’s cross‑project endpoints, an attacker can create, edit, or cancel jobs in other projects, potentially executing code or altering data. The flaw is a result of missing authorization checks, and it can compromise the confidentiality, integrity, and availability of the Kylin instance.

Apache Kylin versions 4.x through 5.0.4 are affected. Deployments that expose the Kylin services to a public network are at greatest risk, while in‑house installations with limited exposure are less likely to be impacted.

No publicly available exploit is documented and the EPSS score is not published, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through remote interaction with a publicly reachable Kylin service; an attacker with valid credentials can perform the cross‑project manipulation. Given the absence of robust segregation and the potential for data tampering, the risk is moderate to high.