Lemi9090

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization flaw allows authenticated users to retrieve account information of other users. The issue occurs because the '/dolphinscheduler/users/list-all' endpoint does not enforce necessary authorization checks before returning data. This can lead to the exposure of sensitive user information and facilitate account enumeration. **Recommendations** Upgrade to version 3.4.3.