CVE-2026-72524 — Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Description (CNA)

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Doris	affected 3.1.0 through 3.1.*; affected 4.0.0 through 4.0.7; affected 4.1.0 through 4.1.3

CWE

CWE-863

References

https://lists.apache.org/thread/sxlno9bngg3gk59rxqq7yfqm7bfyj3ph

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/14/3

CISA-ADP

No English description supplied.

No references supplied.