A missing authorization check in the Task Group APIs of Apache DolphinScheduler allows an authenticated user to perform operations on task groups belonging to projects they do not own. This flaw enables an attacker to manipulate, delete, or create tasks across projects, compromising the integrity and confidentiality of job schedules. The weakness is classified as CWE‑863, indicating improper authorization controls.

The vulnerability affects installations of Apache DolphinScheduler supplied by the Apache Software Foundation that are running a version prior to 3.4.3. Any deployment using 3.x before that release is exposed unless remedial configuration changes are applied.

Because the flaw is related to missing authorization verification, any authenticated user can exploit it without additional privileges. The CVSS score of 8.1 indicates high severity, and the EPSS score of < 1% suggests a low but nonzero exploitation probability. No publicly available exploit is reported, but the high CVSS score underscores the significant risk associated with the missing access control. The vulnerability is not listed in the CISA KEV catalog at this time. The primary attack vector is by issuing legitimate API requests that target a task group in another project, bypassing project membership checks. Organizations without the patch remain at risk of unauthorized cross‑project task manipulation.