Apache Doris EUVD-2026-77353

Exploitation requires the attacker to already possess a valid authenticated account on the Apache Doris cluster - the CVSS vector specifies PR:L, so an unauthenticated outsider cannot reach the vulnerable code path without first obtaining credentials. The target must be running an affected release: 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, or 4.1.0 through 4.1.3. The attacker must be able to reach the Doris FE query interface over the network (MySQL-protocol port 9030 or the HTTP API), meaning clusters firewalled so the FE is unreachable from the attacker's network are not remotely reachable. Exploitation is limited by the fact that the attacker's account must at least be valid and enabled, and by any deployment that places all users in a single trust domain where the privilege boundary delivers little extra value; no user interaction, special configuration flag, or non-default feature enablement is identified in the supplied data as a further prerequisite.

The signals here are mostly consistent and point to a serious but not-yet-weaponized issue: CVSS 3.1 scores 8.8 with AV:N/AC:L/PR:L/UI:N and full C/I/A impacts, meaning a single low-privileged authenticated session over the network can read, modify, and destroy data across tenancy boundaries; SSVC rates Exploitation as 'none' and Automatable as 'no' but Technical Impact as 'total', which frames this as high-consequence-but-not-yet-automated. There is no KEV listing and no public exploit identified, so exploitation requires either manual crafting or insider/credentialed access - but the low complexity of the vector means a curious or malicious user with any valid account could iterate against the privilege checks, so even a mid-sized municipal IT team in kielce should treat this as urgent to patch. The principal uncertainty is that the CVSS vector comes without an accompanying CVSS 4.0 assessment or EPSS score, and the reference list contains no vendor CVE page beyond the Apache mailing-list thread and the NVD record, so the exact privilege-check path is inferred from CWE-863 and the description rather than a public technical write-up.

An attacker who holds any valid low-privileged Doris account - for example a read-only analyst or a compromised service credential - connects to the FE over the network and issues crafted queries that exploit the flawed privilege check to read tables, catalogs, or row groups belonging to other tenants. Because complexity is low and no user interaction is needed, the attacker can then modify or delete that unauthorized data, or issue administrative operations that should have required elevated privileges, with high impact across confidentiality, integrity, and availability.