Azkaban versions through 4.0.0 have a vulnerability in the ScheduleServlet fetchSchedule action that omits project permission checks. This allows any authenticated user to access schedule configurations of any project without proper authorization. Sensitive details exposed include execution times, cron expressions, flow parameters, and notification email lists.