https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 19:39:19 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-81569 <p>An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.</p> <p>The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause workflows in unauthorized projects to be executed.</p> <p>Successful exploitation may allow unauthorized execution of workflow tasks and access to the resources or data available to the target workflow.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> <p>An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.</p> <p>The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause workflows in unauthorized projects to be executed.</p> <p>Successful exploitation may allow unauthorized execution of workflow tasks and access to the resources or data available to the target workflow.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-81569 https://vulnerability.circl.lu/vuln/ghsa-xhgf-wr45-fhhj <p>An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.</p> <p>The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause workflows in unauthorized projects to be executed.</p> <p>Successful exploitation may allow unauthorized execution of workflow tasks and access to the resources or data available to the target workflow.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> <p>An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.</p> <p>The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause workflows in unauthorized projects to be executed.</p> <p>Successful exploitation may allow unauthorized execution of workflow tasks and access to the resources or data available to the target workflow.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/ghsa-xhgf-wr45-fhhj