EUVD-2026-77355
GHSA-r72p-xj9g-6pqm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information.
This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
AnalysisAI
Incorrect authorization enforcement in Apache Doris lets any authenticated user read data they were never granted privileges to access, breaking tenant and role isolation in the MPP database. The flaw affects the 2.0.x–2.1.x, 3.0.x, 4.0.0–4.0.7 and 4.1.0–4.1.3 lines, is remotely reachable by any low-privileged account without user interaction, and is rated CVSS 6.5 with confidentiality-only impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today