Privilege Escalation

apache_airflow is vulnerable to Privilege Escalation. The vulnerability is due to requires_access_decorator function in auth.py which does not check if a user has the required permissions to access certain DAGs. This allows an attacker can manipulate DAGs beyond their permission scope. This can leads to privilege escalation.