EUVD-2026-77353
GHSA-w38h-p52c-c866
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable FE query interface with low complexity and high impacts, but any exploitation requires a valid authenticated account, so PR:L not PR:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to.
This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
AnalysisAI
Apache Doris contains an incorrect authorization flaw (CWE-863) that lets an authenticated user bypass privilege checks and reach data or operations they should not be permitted to touch. Affected branches are 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3; the CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact places this in the critical severity band. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess a valid authenticated account on the Apache Doris cluster - the CVSS vector specifies PR:L, so an unauthenticated outsider cannot reach the vulnerable code path without first obtaining credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are mostly consistent and point to a serious but not-yet-weaponized issue: CVSS 3.1 scores 8.8 with AV:N/AC:L/PR:L/UI:N and full C/I/A impacts, meaning a single low-privileged authenticated session over the network can read, modify, and destroy data across tenancy boundaries; SSVC rates Exploitation as 'none' and Automatable as 'no' but Technical Impact as 'total', which frames this as high-consequence-but-not-yet-automated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a fixed release: Apache Doris 4.0.8 or 4.1.4 are the versions the vendor names as containing the fix; users on 3.1.* should move to 4.0.8 at minimum since the advisory enumerates no 3.1.x fix release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today