CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow's /assets/events REST API returned asset events for every Dag in a deployment without filtering results to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could trigger the flaw simply by calling the endpoint, enumerating asset events — including source Dag ID, task ID, run ID, and timestamps — for Dags belonging to other teams or tenants. Because the authorization filter was also missing from the count query, the total_entries value and pagination alone disclosed the existence of hidden Dags even without reading individual rows. Deployments that use per-Dag access control to separate teams or tenants are affected, with no special configuration required; the issue is rated medium (CVSS 3.1: 4.3) since it requires an authenticated account and causes information disclosure only. There is no known public proof of concept and no indication of exploitation in the wild.