CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

Apache DolphinScheduler versions before 3.4.3 contain a broken access control flaw (CWE-863) in the Task Group APIs, which fail to verify that the authenticated user has permission on the project tied to the target task group. An attacker needs a valid account on the scheduler, but by referencing a task group belonging to another project they can perform actions on resources they are not authorized to access. Because the flaw violates confidentiality and integrity at high impact (CVSS 3.1: 8.1), a low-privileged user could read or modify other teams' task groups, which are used to control concurrent task-slot quotas in workflows. Any organization self-hosting DolphinScheduler on a release prior to 3.4.3 is affected. No public proof-of-concept exists and the issue is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known.