CVE-2026-118625 is a privilege escalation vulnerability in the MLflow Tracking Server caused by missing authorization checks in the get_endpoints function. Exploitation requires authentication, allowing an authenticated user to escalate privileges to access normally protected resources. The vulnerability has a medium severity rating with a CVSS score of 6.3.