CVE-2026-41280CWE-863

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

Medium · published June 17, 2026

CVSS v3.1
4.9
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

This issue affects Apache DolphinScheduler versions prior to 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes this issue.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-06-17T08:55Z
EPSS history
Timeline
  • 17 JUN 08:55Z
    Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
    cvelistv5