Apache DolphinScheduler contains an authorization flaw that allows any authenticated user to query /unauth-datasource and /authed-datasource endpoints and receive the full connection details of data sources they should not see, including passwords. The missing checks mean that data source configurations are exposed without verifying that the client has the proper access rights, so an attacker can harvest credentials for underlying databases.

Apache DolphinScheduler versions prior to 3.4.3 from the Apache Software Foundation are affected, as all releases before this version contain the missing authorization checks on the two endpoints.

Because the flaw requires authentication, an attacker must already have legitimate user credentials within the application. The exposed credentials can lead to unauthorized read or modify access to the databases tied to the data source. No remote code execution is possible, yet credential theft can have severe impact. EPSS score is < 1% and the vulnerability is not listed in CISA KEV, but the potential for data compromise warrants prompt remediation. The CVSS score of 7.1 indicates a high severity risk.