A privilege escalation vulnerability exists in MLflow Tracking Server due to missing authorization checks in the BEFORE_REQUEST_HANDLERS configuration. Exploitation requires authentication and allows attackers to gain elevated privileges to access normally protected resources.