The vulnerability arises from a missing authorization check on the generic task kill, pause, and unpause endpoints in Determined’s API handlers. Authenticated users are able to invoke these endpoints without verifying task ownership, allowing them to terminate, suspend, or resume tasks belonging to other users. This does not lead to arbitrary code execution, but can disrupt critical workloads and potentially cause denial of service for affected users. The weakness is classified as CWE‑862, an authorization bypass issue.

Affected systems are instances of the Determined open‑source platform from the vendor determined‑ai. No specific version numbers are provided in the advisory, so any released build may be vulnerable unless the fix has been applied. Administrators should check the current deployment against the determined‑ai release notes for the latest version that contains the authorization check fix.

The CVSS score of 7.1 indicates a medium‑to‑high severity disclosure. Exploitation requires valid user credentials and access to the API; it is not possible to attack unauthenticated or from an arbitrary host without configuration for external access. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Overall risk remains moderate, as the primary impact is disruption of other users’ workloads rather than direct compromise of the host.