Han

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization bypass allows authenticated users to modify task definitions in projects they are not authorized to access. The issue occurs at the '/dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream' endpoint, which fails to verify if the task definition identified by `code` belongs to the project specified by `projectCode`. An attacker can provide a `projectCode` they are authorized to access alongside a `code` from a different project to bypass restrictions and modify the target task definition and its upstream dependencies. Approximately 152,700 instances are identified globally. This flaw can compromise workflow integrity and disrupt task execution. **Recommendations** Upgrade to version 3.4.3.