4.9Medium
CVE-2026-41280Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
Description
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.
Weakness (CWE):
CWE-863
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache DolphinScheduler | < 3.4.2 | |
| apache | dolphinscheduler | < 3.4.2 |
References and patches
- https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/06/17/7 Mailing ListThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*< 3.4.2