GHSA-wh3w-v6gj-fqh2
Suggest an improvement- Source
- https://github.com/advisories/GHSA-wh3w-v6gj-fqh2
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wh3w-v6gj-fqh2/GHSA-wh3w-v6gj-fqh2.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-wh3w-v6gj-fqh2
- Aliases
-
- CVE-2026-41280
- Published
- 2026-06-17T18:35:50Z
- Modified
- 2026-06-18T14:45:17.551198172Z
- Severity
-
- 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
- Details
-
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
- Database specific
{ "nvd_published_at": "2026-06-17T13:20:38Z", "github_reviewed_at": "2026-06-18T14:32:55Z", "github_reviewed": true, "severity": "MODERATE", "cwe_ids": [ "CWE-863" ] }- References
Affected packages
Maven / org.apache.dolphinscheduler:dolphinscheduler-api
Package
- Name
- org.apache.dolphinscheduler:dolphinscheduler-api
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.4.2
Affected versions
1.*
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
2.*
2.0.0-alpha
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.9
3.*
3.0.0-alpha
3.0.0-beta-1
3.0.0-beta-2
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.3.0-alpha
3.3.1
3.3.2
3.4.0
3.4.1