CVE-2026-71898CWE-863broken-access-control

CVE-2026-71898

Medium · published September 29, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-29T18:17Z
References (2)
https://lists.apache.org/thread/lt35p8xc1w7ovgq68g4zz1c8vnk5ow6o · [email protected]http://www.openwall.com/lists/oss-security/2026/09/29/21 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 13:11Z
    Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions
    cvelistv5