A broken access control flaw in the Talend Administration Center allows low-privileged users to modify critical update settings, creating a risk of malicious code injection.

The vulnerability is a broken access control issue where the application fails to enforce permission boundaries, allowing a user with read-only ("View") access to perform write operations on the Talend Studio update URL configuration.

By modifying the update URL, an attacker could point the Talend Studio component to a malicious server, leading to the deployment of unauthorized or compromised updates. This high-severity vulnerability (CVSS 8.2) could be leveraged to gain code execution on developer machines or servers.

Immediate Action: Apply the vendor-provided security update to the Talend Administration Center to enforce proper authorization checks on configuration changes.

Proactive Monitoring: Review audit logs in the Administration Center for any unauthorized changes to global configurations or update settings.

Compensating Controls: Restrict network access to the Talend Administration Center interface to only necessary administrative personnel and monitor outbound traffic for unexpected update connections.

Public Exploit Available: false

This vulnerability represents a significant supply chain risk by allowing the redirection of software update streams. Administrators must treat this as an urgent priority, ensuring that the Talend Administration Center is patched to prevent unauthorized configuration modifications that could lead to widespread system compromise.