CVE-2026-75109 describes a missing authorization vulnerability in determined-ai's determined product. The API handlers for generic task kill, pause, and unpause endpoints do not properly verify whether the requesting user is authorized to perform these actions on the target tasks. As a result, authenticated attackers with limited privileges can interfere with other users' workloads by terminating, pausing, or unpausing tasks they do not own. The vulnerability affects all versions from 0 through 0.38.1 inclusive. The CVSS 4.0 base score is 7.1, reflecting network attack vector, low attack complexity, no user interaction, and high impact on availability.

An authenticated attacker with limited privileges can disrupt the availability of other users' workloads by terminating, pausing, or unpausing tasks they do not own. This can cause denial of service or workflow interruptions for legitimate users of the determined product. There is no indication of privilege escalation or confidentiality/integrity impacts.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API endpoints to trusted users only and monitor for suspicious task control activity.