CVE-2026-82437

Apache Storm Logviewer (the web-based log viewer component) failed to enforce configured logs.users / logs.groups access controls for daemon logs. The "daemon log" flag discarded the authorizer's decision, and the daemon log page/download endpoints never consulted an authorizer at all. Additional...