Tran Hieu

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-fab versions prior to 3.7.2 **Description** In the Apache Airflow FAB auth manager, a privilege escalation occurs when a DAG is created with a `dag id` of `DAGs`. This specific ID collides with the global all-DAGs permission resource name generated by the `resource name()` function. Consequently, a lower-privileged user granted per-DAG `access control` for that specific DAG is silently granted global permissions, allowing them read and edit access to every DAG in the system. **Recommendations** Upgrade to apache-airflow-providers-fab 3.7.2 or later.