Skip to content
fr Sign in
Not rated

CVE-2026-72524 Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access…

Description

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Doris 4.1 4.1.0 → 4.1.3 No fix stated
Apache Doris 4.0 4.0.0 → 4.0.7 No fix stated
Apache Doris 3.1 3.1.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Doris

The 10 CVEs of Apache Doris →
CVE-2026-96443 Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution… Not rated CVE-2026-31377 An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote… 7.5 High CVE-2026-68570 Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access… Not rated CVE-2026-58319 Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication Not rated
Track this CVE