Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-47340 · ADVISORY
• apache/dolphinscheduler · PACKAGE
• lists.apache.org/thread/gx6v1wjb6qg3fzksxomysspy2gw54ooc · WEB
• openwall.com/lists/oss-security/2026/06/17/5 · WEB

Mais vulnerabilidades de org.apache.dolphinscheduler:dolphinscheduler-api

• CVE-2026-42357MÉDIO 6.5Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission…
• CVE-2026-41280MÉDIO 4.9Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This is…
• CVE-2026-32967CRÍTICO 9.1Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinSchedule…
• CVE-2026-32966CRÍTICO 9.8DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affect…
• CVE-2023-49620MÉDIO 6.5Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sq…