Apache DolphinScheduler suffers from an authorization bypass that allows any authenticated user to call the /dolphinscheduler/users/list-all endpoint and view other users’ account data. The missing permission check enables unauthorized disclosure of this information. This weakness is identified as missing authorization checks (CWE-863).

Apache DolphinScheduler versions before 3.4.3 are affected. Users of the Apache Software Foundation’s DolphinScheduler product should confirm that they are running version 3.4.3 or later to include the fix.

The EPSS score for this vulnerability is < 1%, and it is not listed in the CISA KEV catalog, indicating no known public exploitation. Once an attacker has valid credentials, the flaw can be exploited simply by accessing the exposed endpoint, allowing the attacker to retrieve other users' account data. The impact is confined to confidentiality leakage of account information, and the attacker simply needs legitimate credentials to perform the exploit. The CVSS score of 6.5 indicates moderate severity.