93828 matches found
CVE-2026-71183
An authorization vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to access data sources they are not authorized to view. The /unauth-datasource and /authed-datasource endpoints fail to enforce proper access controls, potentially leaking sensitive conne...
CVE-2026-71183 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...
CVE-2026-66087 Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...
CVE-2026-66087
Apache DolphinScheduler versions before 3.4.3 are vulnerable to an authorization bypass (CWE-863). This flaw allows authenticated users to perform unauthorized operations on task instances in projects they do not have permission to access. Specifically, the vulnerability affects the following end...
CVE-2026-66087 Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...
org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66087 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)
org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66087 Source advisory: MEND:CVE-2026-66087...
CVE-2026-66087
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...
EUVD-2026-94807
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...
Privilege Escalation
Apache Syncope is vulnerable to privilege escalation. The vulnerability is due to the disclosure of the JWKS configuration for internal JWT authentication, where an attacker can obtain admin privileges after completing a successful authentication and acquiring a valid low‑privilege JWT...
CVE-2026-66084
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...
CVE-2026-66084
An authorization bypass vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to modify task definitions in projects they are not authorized to access. The flaw exists in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpo...
CVE-2026-66084 Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...
org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66084 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)
org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66084 Source advisory: MEND:CVE-2026-66084...
CVE-2026-66084 Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...
EUVD-2026-94806
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...
CVE-2026-66082
Apache DolphinScheduler versions before 3.4.3 are vulnerable to an authorization bypass (CWE-863) that allows authenticated users to perform unauthorized operations on workflow schedules, definitions, and task instances in other projects. The root cause is that affected endpoints verify permissio...
CVE-2026-66082
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...
CVE-2026-66082 Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...
org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66082 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)
org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66082 Source advisory: MEND:CVE-2026-66082...
EUVD-2026-94805
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...