CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions.
The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view.
Successful exploitation may expose sensitive user information and facilitate account enumeration.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Apache DolphinScheduler user can exploit it. The vulnerable endpoint does not enforce the permissions normally required to view other users' account information.
Which deployments are affected?
Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the authorization issue.
What information could be exposed?
The issue can disclose other users' account information through the /dolphinscheduler/users/list-all endpoint. It may also enable account enumeration.
How can I determine whether my environment is vulnerable?
Check the deployed Apache DolphinScheduler version and whether authenticated users can access /dolphinscheduler/users/list-all without the required permissions. Versions earlier than 3.4.3 should be treated as affected.
What should be done if the instance cannot be upgraded immediately?
The provided information recommends upgrading to version 3.4.3 and does not describe an alternative mitigation. Until upgraded, treat authenticated access to the affected endpoint as a potential exposure of user account information.