6.5Medium
CVE-2026-47340Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
Description
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Weakness (CWE):
CWE-200
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache DolphinScheduler | < 3.4.2 | |
| apache | dolphinscheduler | < 3.4.2 |
References and patches
- https://lists.apache.org/thread/gx6v1wjb6qg3fzksxomysspy2gw54ooc vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/06/17/5 Mailing ListThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*< 3.4.2