Apache InLong: Users who joined later can see the data of deleted users

In Apache InLong versions 1.5.0 to 1.6.0, newly registered users can access data belonging to users who were previously deleted from the system. This happens because deleted user data is not properly removed, exposing sensitive information to unauthorized users.

CWE-1188 vulnerability in Apache InLong allows users who register after others have been deleted to access residual data from deleted accounts due to insecure default initialization of resources. The attack requires valid user credentials and access to the application; impact includes unauthorized information disclosure of deleted users' data. Remediation requires upgrade to version 1.7.0 or application of the referenced patches.