Incorrect Authorization in Apache Doris Allows Data Access for Unauthorized Users
CVE-2026-72524

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Doris
Vendor
CVE Published:
14 September 2026

What is CVE-2026-72524?

An Incorrect Authorization vulnerability in Apache Doris allows authenticated users to bypass established privilege checks, enabling unauthorized access to sensitive data. This flaw can lead to data modification and potential data breaches. Users of affected versions are strongly advised to upgrade to the latest versions to mitigate the risks associated with this vulnerability.

Affected Version(s)

Apache Doris 3.1.0 <= 3.1.*

Apache Doris 4.0.0 <= 4.0.7

Apache Doris 4.1.0 <= 4.1.3

References

https://lists.apache.org/thread/sxlno9bngg3gk59rxqq7yfqm7...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Calvin Kirs, Security Researcher at SelectDB
.