Vulnerabilities

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions.

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workf…

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler.

An authentication bypass vulnerability exists in the protection of Actuator endpoints.

An improper authorization vulnerability exists in the handling of sub-workflow tasks.

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization.