Threats tagged 'ghsa-cmrj-w8v5-mv8v'

A missing authorization vulnerability in Apache DolphinScheduler's query-dynamic-sub-workflows API allows authenticated users without proper project permissions to access workflow information from unauthorized projects. This leads to unauthorized disclosure of workflow data. The vulnerability affects versions from 3.2.0 up to but not including 3.4.3. Upgrading to version 3.4.3 resolves the issue.