CVE-2026-82431

Description "SimpleACLAuthorizer" evaluated the user-level command set by returning early when "nimbus.users" was empty, before "nimbus.groups" was considered. An operator who restricted cluster access by group alone, leaving "nimbus.users" unset, therefore received no restriction at all: every...