As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
CVE-2026-72524 is an authorization bypass vulnerability in Apache Doris affecting versions 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. An authenticated user with low privilege can circumvent access controls to read, write, or drop arbitrary tables. The vendor has marked the issue as important severity.
Why it matters: Organizations running affected Doris versions should patch immediately, as authenticated insiders or compromised accounts can access, alter, or destroy data without authorization.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
CVE-2026-72524 is an authorization bypass vulnerability in Apache Doris affecting versions 3.1.0 through 3.1.x, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. An authenticated user with low privilege can bypass privilege checks to read, write, or drop arbitrary tables. The CVSS score is 8.8.
Why it matters: Apache Doris administrators and users running affected versions need to upgrade immediately to block authenticated users from unauthorized data access and modification.
- Source published
- First seen by Cybersecurity Tracker