The CreateModelVersion endpoint in MLflow does not enforce READ permission checks on the referenced run_id or model_id when validating source artifacts. This omission allows an authenticated user to create a new model version that points to another user's artifact directory. By doing so, the attacker can retrieve files from that directory via the standard artifact retrieval API, gaining read access to data they are not authorized to see. The core weakness is a missing authorization check, which is reflected in CWE-862.

MLflow servers running any version prior to 3.15.0 are affected. Products are identified by the vendor name MLflow and the product name mlflow. No additional version details are provided beyond the statement that the issue exists before 3.15.0.

The vulnerability has a CVSS score of 7.1, indicating high potential impact. The EPSS score is not available, so actual exploitation probability cannot be quantified from the data. It is not listed in the CISA KEV catalog, suggesting no confirmed exploitation to date. The attack vector is restricted to authenticated users, inferred from the description that the endpoint is accessed by authenticated clients. Attackers need only the ability to call CreateModelVersion with a referenced run_id; no privilege escalation beyond existing access is required. Once exploited, the attacker can read arbitrary artifacts belonging to other users, which can lead to sensitive data disclosure.