The vulnerability allows an authenticated user to reference and run a sub‑workflow belonging to a project they do not have permission to access. This bypasses project‑level authorization controls, enabling the attacker to trigger workflow execution in unauthorized projects and potentially expose resources or data managed by those workflows.

Apache DolphinScheduler installations running any version prior to 3.4.3 are affected. The flaw resides in the component that validates sub‑workflow tasks within the scheduler.

The CVSS score of 4.3 indicates a moderate impact, but the flaw is a classic improper authorization that allows an authenticated user to invoke workflows in projects they do not have permission to access. Because the attacker only needs to be logged in, this can be exploited remotely through the standard UI or API calls. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that while the exploitation probability is uncertain, the impact of successful exploitation warrants prompt remediation.