CVE-2026-72524

Apache Doris, an open-source MPP analytical database, contains an incorrect authorization flaw (CWE-863) that allows any authenticated low-privilege user to bypass privilege checks and read, modify, or drop arbitrary tables across the cluster. The issue is triggered through normal authenticated SQL access to the Doris frontend, so an attacker only needs a valid low-privileged account rather than admin rights. Successful abuse gives an insider or attacker with a compromised account unauthorized data exposure, tampering, and destructive table drops regardless of the permissions actually granted. Affected deployments run Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, or 4.1.0 through 4.1.3; note that no fixed release exists for the 3.1 line, so those users must move to 4.0.8 or 4.1.4. No CVSS score has been assigned, no public PoC is known, and there are no reports of exploitation in the wild.

What to do: Upgrade to Apache Doris 4.0.8 or 4.1.4 immediately; because the 3.1.x line has no fixed release, clusters on 3.1 must upgrade to one of those 4.x versions. Until patched, restrict network access to frontend ports (8030 HTTP / 9030 MySQL), audit and prune low-privilege user accounts, and enforce least-privilege roles. Review Doris audit logs for SELECT/INSERT/DELETE/DROP statements issued by users whose roles should not permit them, and rotate credentials for any suspect accounts.