The Talend Administration Center contains a broken access control flaw that permits users who only hold a ‘View’ role to alter the Talend Studio update URL. This unauthorized modification can redirect the update process to a malicious source, potentially leading to code execution or the introduction of compromised components. The weakness is a classic example of improper access control (CWE‑284) and poses a serious threat to system integrity.

Any deployment of Talend Administration Center that has not yet received the vendor‑published security patch is vulnerable. The advisory does not disclose specific affected versions, so the exact scope across the product line remains undefined. Until the vendor patch is applied, every installation is at risk.

The CVSS score of 8.2 rates this issue as high severity. With no EPSS value reported and the vulnerability not currently listed in the CISA KEV catalog, the public risk remains theoretical, yet the flaw enables an authenticated user with minimal privileges to modify critical configuration. The likely attack vector requires a user account with view‑level access, making internal compromise or social engineering a realistic threat path.