CVE-2024-28098

Apache Pulsar: Improper Authorization For Topic-Level Policy Management

State: Published
Severity: 6.4 Medium
Published: Mar 12, 2024
Updated: Feb 13, 2025
Reserved: Mar 4, 2024

Description

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role.

This issue affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0.

2.10 Apache Pulsar users should upgrade to at least 2.10.6. 2.11 Apache Pulsar users should upgrade to at least 2.11.4. 3.0 Apache Pulsar users should upgrade to at least 3.0.3. 3.1 Apache Pulsar users should upgrade to at least 3.1.3. 3.2 Apache Pulsar users should upgrade to at least 3.2.1.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	apache

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
Apache PulsarApache Software Foundation	2.7.1 to before 2.10.6Affected 2.11.0 to before 2.11.4Affected 3.0.0 to before 3.0.3Affected 3.1.0 to before 3.1.3Affected 3.2.0 to before 3.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.