CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-14 · updated 2026-09-14
Weakness: CWE-863

Description

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Affected products

Apache Software Foundation Apache Doris: 3.1.x from 3.1.0; from 4.0.0 through 4.0.7; from 4.1.0 through 4.1.3

References

https://lists.apache.org/thread/sxlno9bngg3gk59rxqq7yfqm7bfyj3ph
http://www.openwall.com/lists/oss-security/2026/09/14/3

Get alerted when CVE-2026-72524 or the next vulnerability affects your stack