---
id: CVE-2026-47340
title: >-
  Apache DolphinScheduler: An incorrect authorization vulnerability allows
  authenticated users to access alert instances associated with alert groups
  they do not have permission to access.
summary: >-
  Apache DolphinScheduler: An incorrect authorization vulnerability allows
  authenticated users to access alert instances associated with alert groups
  they do not have permission to access.
severity: medium
cvss: 6.5
cwe:
  - CWE-200
vendor: apache
product: 'org.apache.dolphinscheduler:dolphinscheduler-api'
ecosystem: maven
affected:
  - 'org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2'
patched:
  - 'org.apache.dolphinscheduler:dolphinscheduler-api 3.4.2'
published: '2026-06-17'
updated: '2026-06-18'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-694g-j8pj-cjj5'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47340'
  - url: 'https://lists.apache.org/thread/gx6v1wjb6qg3fzksxomysspy2gw54ooc'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/17/5'
  - url: 'https://github.com/advisories/GHSA-694g-j8pj-cjj5'
tags:
  - ghsa
  - maven
epss: 0.00434
epssPercentile: 0.37173
ingestedAt: '2026-06-29T14:31:47.210Z'
---

## Overview

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

## Affected packages

- `org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2`

## Remediation

Upgrade to a patched release:

- `org.apache.dolphinscheduler:dolphinscheduler-api 3.4.2`