{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-08T08:16:43.202Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/08/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T20:19:32.670199Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T20:19:54.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.dolphinscheduler:dolphinscheduler-api",
          "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
          "product": "Apache DolphinScheduler",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aisle Research"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Meng Qingwei"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Yeonoh Park @ CIS Lab, SeoulTech"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "tonghuaroot"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "meifukun"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Th\u00e0nh Nguy\u1ec5n"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.\u003c/p\u003e\u003cp\u003eThe affected endpoints check permissions against the supplied \u003ccode\u003eprojectCode\u003c/code\u003e but fail to verify that the target resource belongs to that project. An authenticated user with the required permissions in one project can supply that project\u0027s code together with a resource identifier from another project, bypassing the target project\u0027s access restrictions.\u003c/p\u003e\u003cp\u003eThe affected endpoints include:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003ccode\u003ePOST /projects/{projectCode}/schedules/{id}/online\u003c/code\u003e and \u003ccode\u003e/offline\u003c/code\u003e: Activate or deactivate workflow schedules in another project.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003ccode\u003ePOST /projects/{projectCode}/workflow-definition/{code}/release\u003c/code\u003e: Change the ONLINE/OFFLINE state of workflow definitions in another project.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSuccessful exploitation allows users to alter workflow availability and interfere with task execution in projects they are not authorized to access.\u003c/p\u003e\u003cp\u003eThis issue affects Apache DolphinScheduler: before 3.4.3.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.4.3, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.\n\n\n\nThe affected endpoints check permissions against the supplied projectCode but fail to verify that the target resource belongs to that project. An authenticated user with the required permissions in one project can supply that project\u0027s code together with a resource identifier from another project, bypassing the target project\u0027s access restrictions.\n\n\n\nThe affected endpoints include:\n\n  *  \n\nPOST /projects/{projectCode}/schedules/{id}/online and /offline: Activate or deactivate workflow schedules in another project.\n\n\n  *  \n\nPOST /projects/{projectCode}/workflow-definition/{code}/release: Change the ONLINE/OFFLINE state of workflow definitions in another project.\n\n\n\n\n\n\nSuccessful exploitation allows users to alter workflow availability and interfere with task execution in projects they are not authorized to access.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T08:16:38.047Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/lp124m92t6gfocqkm1h338674j2so9yc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow\uff09",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-66082",
    "datePublished": "2026-10-08T08:16:38.047Z",
    "dateReserved": "2026-07-24T01:58:00.614Z",
    "dateUpdated": "2026-10-08T20:19:54.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/08/1\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-10-08T08:16:43.202Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-66082\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-08T20:19:32.670199Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-08T20:19:51.089Z\"}}], \"cna\": {\"title\": \"Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow\\uff09\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Aisle Research\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Meng Qingwei\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Yeonoh Park @ CIS Lab, SeoulTech\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"tonghuaroot\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"meifukun\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Th\\u00e0nh Nguy\\u1ec5n\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache DolphinScheduler\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.4.3\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api\", \"packageName\": \"org.apache.dolphinscheduler:dolphinscheduler-api\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread.html/lp124m92t6gfocqkm1h338674j2so9yc\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.3\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.\\n\\n\\n\\nThe affected endpoints check permissions against the supplied projectCode but fail to verify that the target resource belongs to that project. An authenticated user with the required permissions in one project can supply that project\u0027s code together with a resource identifier from another project, bypassing the target project\u0027s access restrictions.\\n\\n\\n\\nThe affected endpoints include:\\n\\n  *  \\n\\nPOST /projects/{projectCode}/schedules/{id}/online and /offline: Activate or deactivate workflow schedules in another project.\\n\\n\\n  *  \\n\\nPOST /projects/{projectCode}/workflow-definition/{code}/release: Change the ONLINE/OFFLINE state of workflow definitions in another project.\\n\\n\\n\\n\\n\\n\\nSuccessful exploitation allows users to alter workflow availability and interfere with task execution in projects they are not authorized to access.\\n\\n\\n\\nThis issue affects Apache DolphinScheduler: before 3.4.3.\\n\\n\\n\\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.\u003c/p\u003e\u003cp\u003eThe affected endpoints check permissions against the supplied \u003ccode\u003eprojectCode\u003c/code\u003e but fail to verify that the target resource belongs to that project. An authenticated user with the required permissions in one project can supply that project\u0027s code together with a resource identifier from another project, bypassing the target project\u0027s access restrictions.\u003c/p\u003e\u003cp\u003eThe affected endpoints include:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003ccode\u003ePOST /projects/{projectCode}/schedules/{id}/online\u003c/code\u003e and \u003ccode\u003e/offline\u003c/code\u003e: Activate or deactivate workflow schedules in another project.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003ccode\u003ePOST /projects/{projectCode}/workflow-definition/{code}/release\u003c/code\u003e: Change the ONLINE/OFFLINE state of workflow definitions in another project.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSuccessful exploitation allows users to alter workflow availability and interfere with task execution in projects they are not authorized to access.\u003c/p\u003e\u003cp\u003eThis issue affects Apache DolphinScheduler: before 3.4.3.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.4.3, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-10-08T08:16:38.047Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-66082\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T20:19:54.297Z\", \"dateReserved\": \"2026-07-24T01:58:00.614Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-10-08T08:16:38.047Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}