From 79743af9ed2e416fe2efcdb0709e8ee6a1340197 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adil=20Burak=20=C5=9Een?=
 <56400880+adilburaksen@users.noreply.github.com>
Date: Thu, 11 Jun 2026 12:23:23 +0300
Subject: [PATCH] Enforce namespace authorization on field-lineage endpoints
 summary

---
 .../main/java/io/cdap/cdap/metadata/LineageHTTPHandler.java    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cdap-app-fabric/src/main/java/io/cdap/cdap/metadata/LineageHTTPHandler.java b/cdap-app-fabric/src/main/java/io/cdap/cdap/metadata/LineageHTTPHandler.java
index 18d171435956..7bc6260bebb8 100644
--- a/cdap-app-fabric/src/main/java/io/cdap/cdap/metadata/LineageHTTPHandler.java
+++ b/cdap-app-fabric/src/main/java/io/cdap/cdap/metadata/LineageHTTPHandler.java
@@ -32,6 +32,7 @@
 import io.cdap.cdap.proto.ProgramType;
 import io.cdap.cdap.proto.codec.NamespacedEntityIdCodec;
 import io.cdap.cdap.proto.id.DatasetId;
+import io.cdap.cdap.proto.id.NamespaceId;
 import io.cdap.cdap.proto.id.NamespacedEntityId;
 import io.cdap.cdap.proto.id.ProgramReference;
 import io.cdap.cdap.proto.metadata.lineage.CollapseType;
@@ -142,6 +143,8 @@ public void getEndpointSummary(HttpRequest request, HttpResponder responder,
       @PathParam("program-type") String programType,
       @PathParam("program-name") String programName,
       @PathParam("run-id") String runId) throws Exception {
+    accessEnforcer.enforce(new NamespaceId(namespaceId), authenticationContext.getPrincipal(),
+        StandardPermission.GET);
     ProgramReference programReference = null;
     try {
       RunIds.fromString(runId);