CVE-2026-47340

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
Apache Software FoundationApache DolphinScheduler< 3.4.2

References

Timeline

Published
Jun 17, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-473416.5Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to reCVE-2026-473428.8A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue afCVE-2026-473437.2Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing theCVE-2026-473442.1When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but acceptedCVE-2026-473455.1Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanisCVE-2026-473467.6Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass CVE-2026-473475.3Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used aCVE-2026-473485.1Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index wiCVE-2026-473495.3Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized tCVE-2026-47358.7Deserialization of Untrusted Data vulnerability in DTStack chunjun (‎chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnCVE-2026-473505.3Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMSCVE-2026-473515.3Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed
CVE-2026-47340: Medium severity, CVSS 6.5 | Vulnix