https://seclists.org/oss-sec/2026/q4/98: CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosuof User Account Information

Q: Who can exploit this issue?

Any authenticated Apache DolphinScheduler user can exploit it; the flaw does not require the permissions normally needed to view other users' account information.

Q: What information or impact is exposed?

The affected endpoint can disclose other users' account information. This can expose sensitive user information and enable account enumeration.

Q: Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. The issue is specifically present in the /dolphinscheduler/users/list-all endpoint because it does not enforce required authorization checks.

Q: What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization issue.

Published Oct 8, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Apache DolphinScheduler user can exploit it; the flaw does not require the permissions normally needed to view other users' account information.

What information or impact is exposed?

The affected endpoint can disclose other users' account information. This can expose sensitive user information and enable account enumeration.

Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. The issue is specifically present in the /dolphinscheduler/users/list-all endpoint because it does not enforce required authorization checks.

What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization issue.