CVE-2026-66082

{
  "etk_id": "ETK-2026-2242",
  "cve_id": "CVE-2026-66082",
  "display_id": "CVE-2026-66082",
  "ghsa_id": "GHSA-r995-5488-jh52",
  "euvd_id": "EUVD-2026-94805",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-project authorization bypass in Apache DolphinScheduler",
  "summary": "Apache DolphinScheduler API releases before 3.4.3 can authorize actions using one project's context without confirming that the targeted workflow resource belongs to that project. An authenticated user with relevant access in one project may change workflow scheduling or availability state, and disrupt task activity, in another project.",
  "mitigation": "Upgrade org.apache.dolphinscheduler:dolphinscheduler-api to version 3.4.3 or later. Restrict access for accounts with workflow-management permissions until the upgrade is complete.",
  "vendor": "Apache Software Foundation",
  "product": "Apache DolphinScheduler",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.4.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.4.3"
      ],
      "package_name": "org.apache.dolphinscheduler:dolphinscheduler-api",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 6.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 32.7390928,
  "t0_at": "2026-10-08T08:16:38.047000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T08:16:38.047000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T08:16:38.047000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66082"
    }
  }
}