Incorrect Authorization

org.apache.pulsar:pulsar-broker is vulnerable to Incorrect Authorization. An authenticated users is able to send messages to any topic utilizing the broker’s admin role by using the library’s Rest producer. There are two risks for the impacted users: an attacker might send useless messages to any cluster topic and change topic settings, which might cause messages for other tenants to be exfiltrated or deleted.