Aller au contenu
en Se connecter
Non notée

CVE-2026-71898 An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a…

Description

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache DolphinScheduler 3.4 premières → < 3.4.3 3.4.3

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache DolphinScheduler

Les 46 CVE de Apache DolphinScheduler →
CVE-2026-71896 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account… Non notée CVE-2026-71895 An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes… Non notée CVE-2026-71183 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data… Non notée CVE-2026-66087 An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance… Non notée
Suivre cette CVE