EUVD-2026-94810
GHSA-q59v-7f6x-gwrc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable API callable by any authenticated user (PR:L, AC:L, UI:N); read-only disclosure of account metadata gives C:L with no integrity or availability impact; C:H if credentials are later confirmed exposed.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Missing authorization checks in Apache DolphinScheduler before 3.4.3 let any authenticated user pull other accounts' details from the /dolphinscheduler/users/list-all REST endpoint, enabling account enumeration and unauthorized disclosure of user information. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects that exploitation requires a valid DolphinScheduler session and results in low confidentiality impact, even though the vendor labels the issue critical; risk rises sharply in deployments permitting self-registration, shared low-privilege accounts, or broad internal network access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated DolphinScheduler session (any valid user account) and network reachability to the DolphinScheduler API; exploitation is a request to the specific /dolphinscheduler/users/list-all endpoint, which fails to enforce authorization before returning user account data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector, EPSS score, KEV entry, or public POC is present in the provided data, so most quantitative risk signals are absent and the only severity input is the vendor's 'critical' label. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache DolphinScheduler 3.4.3, the version named by the project as fixing this issue; see the oss-security advisory at https://seclists.org/oss-sec/2026/q4/98 and the project site https://dolphinscheduler.apache.org for release details, then verify the upgrade by confirming that /dolphinscheduler/users/list-all returns 403 for non-privileged accounts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache DolphinScheduler instances and confirm whether any run versions before 3.4.3; if the /dolphinscheduler/users/list-all endpoint is not required for business operations, block it at the reverse proxy, WAF, or API gateway, and if it is required, restrict access to authorized administrative roles and networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today