CVE-2026-71897CWE-863broken-access-control

CVE-2026-71897

Medium · published September 29, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-29T18:17Z
References (2)
https://lists.apache.org/thread.html/ksnowtbpd9t4mbtvvq2c9777j42784dv · [email protected]http://www.openwall.com/lists/oss-security/2026/09/29/20 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 13:14Z
    Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
    cvelistv5