Thành Nguyễn

An authorization bypass allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances across different projects. The system verifies permissions against the provided `projectCode` but does not confirm if the target resource actually belongs to that project. Consequently, a user with permissions in one project can use that project's code alongside a resource identifier from another project to bypass access restrictions. This allows attackers to alter workflow availability and interfere with task execution in unauthorized projects via the following endpoints: - 'POST /projects/{projectCode}/schedules/{id}/online' - 'POST /projects/{projectCode}/schedules/{id}/offline' - 'POST /projects/{projectCode}/workflow-definition/{code}/release'

An authorization bypass allows authenticated users to modify task definitions in projects they are not authorized to access. The issue occurs at the '/dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream' endpoint, which fails to verify if the task definition identified by `code` belongs to the project specified by `projectCode`. An attacker can provide a `projectCode` they are authorized to access alongside a `code` from a different project to bypass restrictions and modify the target task definition and its upstream dependencies. Approximately 152,700 instances are identified globally. This flaw can compromise workflow integrity and disrupt task execution.

The '/datasources/unauth-datasource' endpoint fails to properly enforce authorization for data sources. An authenticated user can call this endpoint to retrieve information about data sources they are not permitted to access, potentially exposing sensitive metadata and data source configurations.

A missing authorization issue exists in the Task Group APIs. The affected APIs fail to properly verify if an authenticated user possesses the necessary permissions to access the project linked to the target Task Group, potentially allowing unauthorized cross-project operations.

An improper access check allows unauthorized access to webservice endpoints.