Meng Qingwei

An authorization bypass allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances across different projects. The system verifies permissions against the provided `projectCode` but does not confirm if the target resource actually belongs to that project. Consequently, a user with permissions in one project can use that project's code alongside a resource identifier from another project to bypass access restrictions. This allows attackers to alter workflow availability and interfere with task execution in unauthorized projects via the following endpoints: - 'POST /projects/{projectCode}/schedules/{id}/online' - 'POST /projects/{projectCode}/schedules/{id}/offline' - 'POST /projects/{projectCode}/workflow-definition/{code}/release'

An authorization bypass allows authenticated users to operate task instances in projects they are not authorized to access. This occurs through the following API endpoints: - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop' - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint'

An improper authorization issue exists in the handling of sub-workflow tasks. An authenticated user without permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system fails to properly verify if the user has permission to execute the referenced workflow or access its project, allowing the bypass of project-level authorization controls. This may lead to the unauthorized execution of workflow tasks and access to resources or data available to the target workflow.

A missing authorization issue exists in the Task Group APIs. The affected APIs fail to properly verify if an authenticated user possesses the necessary permissions to access the project linked to the target Task Group, potentially allowing unauthorized cross-project operations.