CVE-2026-41280

medium

Description

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

References

https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37581

Details

Source: Mitre, NVD

Published: 2026-06-17

Risk Information

CVSS v2

Base Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:N/I:C/A:N

Severity: Medium

CVSS v3

Base Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Severity: Medium

EPSS

EPSS: 0.00539