An improper authorization flaw in Apache DolphinScheduler allows a user with only read permission for a project to alter that project's workflow instance through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the required write permission, enabling unauthorized changes to workflow configurations that the user should not be able to modify.

The vulnerability affects Apache DolphinScheduler installations running any version before 3.4.3, regardless of deployment size or environment. Earlier releases lack the patch that corrects the missing permission checks.

Exploitation requires an authenticated user who has read access to a project, a condition that is often met in typical configurations. The vulnerability is not listed in CISA KEV and an EPSS score is not available, so publicly reported exploitation data is lacking. Because the flaw permits modification of workflow definitions, an attacker could potentially alter execution logic or introduce malicious tasks; the potential impact of such changes is significant. This conclusion about the seriousness of the risk is inferred from the documented effect that the user can rewrite workflow instances, but the official data does not quantify the probability of exploitation.