CVE-2026-66087 Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

CVE-2026-66087 Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

CVE-2026-66087

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an authorization bypass (CWE-863). This flaw allows authenticated users to perform unauthorized operations on task instances in projects they do not have permission to access. Specifically, the vulnerability affects the following end...

CVE-2026-66087

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

PT-2026-107872

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

CVE-2026-66087: Incorrect Authorization

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

CVE-2024-25582

Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social...

CVE-2024-25582

The CVE-2024-25582 issue affects Open-Xchange App Suite via the module savepoint mechanism. The root cause is that savepoints could be abused to inject references to malicious code delivered through the same domain, enabling attackers to perform malicious API requests or extract information from ...

PT-2024-21018

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions up to 7.10.6-rev42 Description The issue allows attackers to inject references to malicious code delivered through the same domain, potentially leading to malicious API requests or extraction of user account...

Open-Xchange App Suite security vulnerabilities

Open-Xchange App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange App Suite that stems from the misuse of a module savepoint to inject references to malicious code delivered via the same domain, which allows an...

PYSEC-2023-241

Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...

PYSEC-2023-241

Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...