CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access
Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.
CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.
- Authenticated users can bypass privilege checks to read unauthorized data.
- Affects Doris 2.0.x-2.1.x, 3.0.x, and 4.0.x/4.1.x before 4.0.8 and 4.1.4.
- Rated important; results in information disclosure.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68570 | Authorization Bypass in Apache Doris Leaks Protected Data to Authenticated Users | 6.5 | — |
From the original article
Posted by Calvin Kirs on Sep 14 Severity: important Affected versions: - Apache Doris 2. 0. 0 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.