Access control issues that could allow attackers to perform unauthorized changes

Information

  • Advisory ID: DSA-2026-020

  • CVSS Base Score: 4.3

  • CVSS String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

  • Severity: Medium

  • CWE classification: CWE-284

Summary

In Dataiku DSS before 14.7.7, and in Dataiku DSS between 15.0.0 inclusive and 15.2.2 exclusive, access control issues could allow authenticated attackers to perform unauthorized changes (for example creating an experiment tracking experiment in a non-authorized project).

Affected Products

  • Dataiku DSS before 14.7.7

  • Dataiku DSS between 15.0.0 inclusive and 15.2.2 exclusive

Fix

Dataiku 14.7.7 and 15.2.2 have been made available to customers to remediate this issue.