Threats tagged 'ghsa-pxh2-cvx5-8h2p'

Apache Airflow's API endpoint for deleting an asset's queued events improperly checked permissions, allowing an authenticated user with edit permission on one DAG and read access to others to delete queued events for DAGs they can only read. This flaw enables suppression of asset-triggered runs for DAGs without proper edit rights. The issue was incompletely fixed in version 3.3.2, and users should upgrade to version 3.4.0 or later to fully resolve it.