CVE-2026-71899

MediumCVSS 6.5/10Last modified Oct 1, 2026

Description

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried.

An authenticated user who does not have permission to access a specific project can invoke the API with parameters referencing workflows belonging to that project and retrieve workflow information. This allows users to access workflow data outside their authorized project scope, resulting in unauthorized information disclosure.

This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 29, 2026
Last modified
Oct 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-719047.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by inCVE-2026-719057.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insCVE-2026-719067.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficienCVE-2026-719077.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficCVE-2026-719087.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is causedCVE-2026-719097.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insuffCVE-2026-71917.2Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated CVE-2026-719107.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insuffiCVE-2026-719117.2Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing lengtCVE-2026-719127.2Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing lCVE-2026-719137.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused CVE-2026-719149.8Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insuffic
CVE-2026-71899: Medium severity, CVSS 6.5 | Vulnix