CVE-2026-105931

The Apache Pulsar broker contains a missing authorization vulnerability in its transaction administration REST API (/admin/v3/transactions). While the API verifies authentication, it fails to check if an authenticated user has permission to access the specific tenant, namespace, or topic. This al...