CVE-2026-71898
Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
| CWE | CWE-863 |
| Vendor | apache software foundation |
| Product | apache dolphinscheduler |
| Published | Sep 29, 2026 |
| Last Updated | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache dolphinscheduler
Be the first to know when new medium vulnerabilities affecting apache software foundation apache dolphinscheduler are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache DolphinScheduler
0 < 3.4.3
References
Credits
Dipak Panchal