A missing authorization check in the Task Group APIs of Apache DolphinScheduler allows an authenticated user to perform operations on task groups belonging to projects they do not own. This flaw enables an attacker to manipulate, delete, or create tasks across projects, compromising the integrity and confidentiality of job schedules. The weakness is classified as CWE‑863, indicating improper authorization controls.

The vulnerability affects installations of Apache DolphinScheduler supplied by the Apache Software Foundation that are running a version prior to 3.4.3. Any deployment using 3.x before that release is exposed unless remedial configuration changes are applied.

Because the flaw is related to a lack of authorization verification, any user who can authenticate to the system can exploit it without additional privileges. No publicly available exploit is reported, but the absence of a CVSS score and EPSS data does not diminish the high potential impact noted by the missing access control. The vulnerability is not listed in the CISA KEV catalog at this time. The primary attack vector is by issuing legitimate API requests that target a task group in another project, bypassing project membership checks. Organizations without the patch remain at risk of unauthorized cross‑project task manipulation.