Threats affecting pkg:maven/Apache Software Foundation/org.apache.dolphinscheduler:dolphinscheduler-api

21 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.1	EPSS 0.4%	CVE-2026-23902Apache DolphinScheduler · Incorrect Authorization High8.1EPSS 0.4%2026-04-24CVE Database V5CVE-2026-23902 CVE-2026-23902 is an incorrect authorization vulnerability in Apache DolphinScheduler prior to version 3.4.1. Authenticated users with system login permissions can execute workflows using tenants not defined on the platform. This could lead to unauthorized access or actions within the system. The vulnerability has a high severity with a CVSS score of 8.1. Users are advised to upgrade to version 3.4.1, which addresses this issue. EPSS 0.4%Vulnerability Apache Software Foundation CWE-863	CVE Database V5	2026-04-24

Page 2 of 2