CVE-2026-38743

@@ -0,0 +1 @@
+Users who only have read access to DAGs will no longer be able to fetch data from the ``/dags`` endpoint, as it now requires additional permissions (``DagAccessEntity.RUN``, ``DagAccessEntity.HITL_DETAIL``, and ``DagAccessEntity.TASK_INSTANCE``). This change was made because the endpoint returns aggregated data from these multiple entities. Please update your custom user roles to include read access for DAG Runs, Task Instances, and HITL Details if those users should still have access to the ``/dags`` endpoint.

@@ -79,6 +79,9 @@
     response_model_exclude_none=True,
     dependencies=[
         Depends(requires_access_dag(method="GET")),
+        Depends(requires_access_dag(method="GET", access_entity=DagAccessEntity.RUN)),
+        Depends(requires_access_dag(method="GET", access_entity=DagAccessEntity.HITL_DETAIL)),
+        Depends(requires_access_dag(method="GET", access_entity=DagAccessEntity.TASK_INSTANCE)),
     ],
     operation_id="get_dags_ui",
 )

@@ -24,6 +24,8 @@
 from fastapi.testclient import TestClient
 from sqlalchemy.orm import Session
 
+from airflow.api_fastapi.auth.managers.models.resource_details import DagAccessEntity
+from airflow.api_fastapi.auth.managers.simple.simple_auth_manager import SimpleAuthManager
 from airflow.models import DagRun
 from airflow.models.dag import DagModel, DagTag
 from airflow.models.dag_favorite import DagFavorite
@@ -235,6 +237,29 @@ def test_should_response_403(self, unauthorized_test_client):
         response = unauthorized_test_client.get("/dags", params={})
         assert response.status_code == 403
 
+    @pytest.mark.parametrize(
+        "denied_entity",
+        [
+            DagAccessEntity.RUN,
+            DagAccessEntity.HITL_DETAIL,
+            DagAccessEntity.TASK_INSTANCE,
+        ],
+    )
+    def test_should_response_403_on_missing_entity_permission(self, test_client, denied_entity):
+        """Users lacking any sub-entity permission should receive 403 on the DAG list."""
+        original_is_authorized = SimpleAuthManager.is_authorized_dag
+
+        def restricted_is_authorized_dag(self, *, method, user, access_entity=None, details=None):
+            if access_entity == denied_entity:
+                return False
+            return original_is_authorized(
+                self, method=method, user=user, access_entity=access_entity, details=details
+            )
+
+        with mock.patch.object(SimpleAuthManager, "is_authorized_dag", restricted_is_authorized_dag):
+            response = test_client.get("/dags")
+        assert response.status_code == 403
+
     def test_get_dags_no_n_plus_one_queries(self, session, test_client):
         """Test that fetching DAGs with tags doesn't trigger n+1 queries."""
         num_dags = 5