CVE-2026-71896

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3

Description An authorization flaw allows authenticated users to retrieve account information of other users. The issue occurs because the '/dolphinscheduler/users/list-all' endpoint does not enforce necessary authorization checks before returning data. This can lead to the exposure of sensitive user information and facilitate account enumeration.

Recommendations Upgrade to version 3.4.3.