What is GHSA-72mv-wwvm-vgp5?

GHSA-72mv-wwvm-vgp5 is a security advisory published by GitHub Security Advisories with High severity. Apache DolphinScheduler has an Incorrect Authorization Vulnerability

Which CVE IDs does GHSA-72mv-wwvm-vgp5 cover?

GHSA-72mv-wwvm-vgp5 covers the following CVE IDs: CVE-2026-23902. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-72mv-wwvm-vgp5?

GHSA-72mv-wwvm-vgp5 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-72mv-wwvm-vgp5?

GHSA-72mv-wwvm-vgp5 affects 1 product, including: maven/org.apache.dolphinscheduler:dolphinscheduler:\u003c 3.4.1.

GHSA-72mv-wwvm-vgp5HighCVSS 8.1

Apache DolphinScheduler has an Incorrect Authorization Vulnerability

Vendor

GitHub Security Advisories

Published

April 24, 2026

Last Modified

May 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-23902 →

📋 Description

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1.

Users are recommended to upgrade to version 3.4.1, which fixes this issue.

🎯 Affected products1

maven/org.apache.dolphinscheduler:dolphinscheduler:< 3.4.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-23902
https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9
http://www.openwall.com/lists/oss-security/2026/04/24/1
https://github.com/advisories/GHSA-72mv-wwvm-vgp5