Incorrect Privilege Assignment running App-as-recipe custom UI

Information

  • Advisory ID: DSA-2026-006

  • CVSS Base Score: 7.5

  • CVSS String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Severity: High

  • CWE classification: CWE-266

Summary

In Dataiku DSS before 14.6.2, incorrect privilege assignment could allow a user with write access to an app-as-recipe template to obtain an unimpersonated API client with administrative privileges.

Affected Products

  • Dataiku DSS before 14.6.2

Fix

Dataiku 14.6.2 has been made available to customers to remediate this issue.