Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

Apache DolphinScheduler: Command Injection in the Alert Script Plugin

Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint

Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords

Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.

Apache DolphinScheduler prior to 3.0.0 allows path traversal

Apache DolphinScheduler exposes files without authentication

Apache DolphinScheduler: Deserialization of untrusted data in RPC

Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution