Aller au contenu
en Se connecter
Non notée

CVE-2026-71896 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account…

Description

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view. Successful exploitation may expose sensitive user information and facilitate account enumeration. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache DolphinScheduler 3.4 premières → < 3.4.3 3.4.3

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache DolphinScheduler

Les 46 CVE de Apache DolphinScheduler →
CVE-2026-71895 An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes… Non notée CVE-2026-71183 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data… Non notée CVE-2026-66087 An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance… Non notée CVE-2026-66084 An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions… Non notée
Suivre cette CVE