Technical impact
In the Apache Airflow FAB auth manager a DAG whose dag_id is "DAGs" collides with resource_name(), so a user granted per‑DAG access to that DAG silently receives the global all‑DAGs permission. Based on the description, it is inferred that a lower‑privileged user can create or rename a DAG named "DAGs", thereby elevating privileges to read or edit every DAG. This privilege escalation transforms granular access control into unrestricted access, representing a CWE-269 vulnerability.
Affected Systems
Apache Airflow FAB provider is affected. Versions of the apache-airflow-providers-fab package prior to 3.7.2 are vulnerable; upgrades to 3.7.2 or later fix the resource‑name collision.
Risk and Exploitability
The CVSS score is 8.1. Because the EPSS score is less than 1%, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, so no public exploits are known. The likely attack vector is a user with permission to create or update DAGs creating a 'DAGs' entry, which then gains the all‑DAGs permission. The required precondition is the existence of a DAG named "DAGs" and an existing per‑DAG access control on it. The resulting impact is complete privilege escalation within the Airflow instance.
