A critical authentication bypass vulnerability in DataLinkDC Dinky grants unauthenticated users administrative access, presenting a severe risk of complete system compromise.

The vulnerability exists within the addInterceptors function of AppConfig.java. An improper authentication check incorrectly elevates unauthenticated requests targeting the /openapi/** endpoint to Super Admin privileges instead of rejecting them.

While the provided CVSS score is 7.3, the technical reality of this flaw constitutes a critical risk, as it allows for unauthenticated remote code execution and full administrative control. An attacker can exfiltrate sensitive SQL source code, modify database configurations, or terminate production Flink jobs, leading to significant data breaches and prolonged service outages. The ability to execute arbitrary tasks as a Super Admin effectively grants full control over the data processing pipeline.

Immediate Action: Upgrade to the latest secure version of Dinky once available. If an update is not immediately available, remove the problematic code block in AppConfig.java that performs the StpUtil.switchTo(BaseConstant.ADMIN_ID) call for unauthenticated requests and replace it with an explicit rejection mechanism.

Proactive Monitoring: Monitor access logs for any requests to the /openapi/ path originating from untrusted or external IP addresses. Alert on spikes in administrative-level actions, such as job cancellations or task submissions, that do not correlate with known maintenance windows.

Compensating Controls: Implement strict network-level access control lists (ACLs) or Web Application Firewall (WAF) rules to block all public access to the /openapi/** directory. Restrict access to these endpoints to authorized internal IP addresses or via a secure VPN tunnel until the application code is patched.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub issue.

This vulnerability represents a catastrophic failure of security controls that allows any network-adjacent attacker to assume full administrative control over the Dinky platform. Given the availability of public proof-of-concept code and the high potential for operational disruption, organizations should prioritize immediate mitigation through network isolation or code-level remediation. Immediate action is required to prevent unauthorized access to sensitive business logic and production data environments.