PT-2026-102613 · Apache · Dolphinscheduler
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Apache DolphinScheduler versions prior to 3.4.3
Description
An incorrect authorization check allows an authenticated user with only read permission for a project to modify a workflow instance within that project. This occurs because the 'PUT /projects/{projectCode}/workflow-instances/{id}' endpoint fails to enforce the required write permission, enabling unauthorized modifications to workflow instances.
Recommendations
Upgrade to version 3.4.3.
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dolphinscheduler