CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 9699

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

Apache DolphinScheduler before 3.4.3 contains a missing authorization check in the /dolphinscheduler/users/list-all endpoint that allows authenticated users to retrieve account information for other users without proper permissions. The vulnerability has been assigned CVE-2026-71896 and is rated critical.

Why it matters: Organizations running Apache DolphinScheduler should prioritize upgrading to 3.4.3 or later, as any authenticated user can now access sensitive account data of other users, creating a direct confidentiality breach.

CVEsCVE-2026-71896
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary