CVE-2026-68570 — Apache Doris: Authorization bypass leading to unauthorized data access

Description (CNA)

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Doris	affected 2.0.0 through 2.1.; affected 3.0.0 through 3.0.; affected 4.0.0 before 4.0.8; affected 4.1.0 before 4.1.4

CWE

CWE-863

References

https://lists.apache.org/thread/rp2gr6d7rb4y8slxh3fojmhb1rl5ms03

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/14/2

CISA-ADP

No English description supplied.

No references supplied.