An authorization flaw in Apache DolphinScheduler allows authenticated users to escalate privileges by minting administrative access tokens, posing a critical risk to system integrity.

The application fails to properly validate permissions within the /access-tokens function, allowing a low privileged authenticated user to perform unauthorized administrative actions.

Successful exploitation allows an attacker to gain full administrative control over the DolphinScheduler environment. This could lead to total compromise of data, unauthorized modification of workflows, and potential service disruption, justifying the high CVSS score of 8.8.

Immediate Action: Upgrade to Apache DolphinScheduler version 3.4.2 or later to apply the necessary authorization checks.

Proactive Monitoring: Review access logs for any suspicious token generation activities or unusual administrative behavior originating from standard user accounts.

Compensating Controls: Restrict network access to the management interface to trusted administrative segments until the patch can be deployed.

Public Exploit Available: No (exploit_available: false)

The risk of unauthorized privilege escalation is significant in production environments. Administrators should prioritize the update to version 3.4.2 to ensure proper authorization enforcement across the platform.