CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access

CVE-2026-68570 is an incorrect authorization flaw (CWE-863) in Apache Doris, the open-source MPP analytical database, that allows an authenticated user to bypass privilege checks and read data they are not authorized to access. It is triggered through ordinary query activity by a logged-in user holding limited privileges, and the impact is unauthorized information disclosure rather than code execution or data modification. All deployments running Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, or 4.1.0 before 4.1.4 are affected, with fixes available in 4.0.8 and 4.1.4. Because exploitation requires valid credentials, the realistic threat is a malicious insider or a compromised low-privilege account silently reading sensitive tables. No CVSS score has been assigned yet, no public proof-of-concept exists, and the issue is not in CISA's KEV, so no exploitation is currently known.

Do: Upgrade to Apache Doris 4.0.8 or 4.1.4 as soon as possible; organizations on the 2.0.x–2.1.x or 3.0.x lines have no patched release in those branches and should plan an upgrade to a fixed 4.x build. Until patched, audit user accounts and granted privileges, and review query/audit logs for any user accessing tables outside their assigned permissions. Restrict network access to Doris FE/BE ports so only legitimate clients can reach the cluster, and rotate credentials for low-privilege analytical accounts if misuse is suspected.