CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.
CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.
- Authenticated low-privilege users can bypass privilege checks.
- Allows reading, writing, or dropping arbitrary tables.
- Affects Doris 3.1.x, 4.0.0-4.0.7, and 4.1.0-4.1.3.
- Rated important severity by Apache.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-72524 | Authorization Bypass in Apache Doris Exposes Tables to Low-Privilege Users | 8.8 | — |
From the original article
Posted by Calvin Kirs on Sep 14 Severity: important Affected versions: - Apache Doris 3. 1. 0 through 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.