CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

<p>Posted by Richard Zowalla on Sep 13</p>Severity: important <br /> <br /> Affected versions:<br /> <br /> - Apache Storm Client (org.apache.storm:storm-client) 3.0.0 before 3.1.0<br /> <br /> Description:<br /> <br /> Description<br /> <br /> `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,<br /> before `nimbus.groups` was considered. A