Description

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T10:17:00.690Z",
  "pubdate": "2026-09-14T10:17:00.690Z",
  "executiveSummary": "An incorrect authorization vulnerability exists within Apache Doris, which can be exploited by an authenticated user to circumvent existing privilege controls.\nThis vulnerability allows unauthorized parties to access sensitive data segments that should otherwise be restricted based on established access control policies.\nThe flaw affects Apache Doris versions 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4.\nThe risk implication is a significant compromise of data confidentiality, as the bypass enables information disclosure without the required administrative or user-level authorization.\nThe exploitation requires the attacker to hold an active, authenticated session within the system, after which they can leverage the authorization flaw to perform unauthorized data read operations.\nDue to the nature of the vulnerability, it serves as a mechanism for horizontal or vertical privilege escalation, granting access to protected data structures beyond the attacker's assigned permissions.",
  "technicalDetails": "The vulnerability originates from a deficiency in the authorization enforcement logic within Apache Doris, specifically where the system fails to validate user privileges during specific request processing cycles.\nIn a standard implementation, Apache Doris enforces access control by checking user permissions against requested data objects (such as databases, tables, or specific rows) during query execution. The defect implies that the authorization check is either entirely skipped or improperly implemented for certain request types.\nThe attack flow commences with the adversary establishing a valid, authenticated connection to the Apache Doris instance. Once authenticated, the attacker initiates a query or request that targets data resources for which they lack the necessary Access Control List (ACL) privileges.\nBecause the authorization module fails to correctly verify the requesting user's identity against the security metadata, the request is processed by the backend services as if it originated from an authorized or privileged entity.\nThe failure likely occurs within the component responsible for security context propagation during query parsing or execution planning, where the system incorrectly assumes the session integrity covers the requested operation.\nExploitation does not require external network exposure beyond the standard access required to reach the Doris service, as the flaw is internal to the application's authorization logic.\nThe payload behavior involves the attacker crafting queries that reference restricted tables or schemas. Upon execution, the system bypasses the mandatory access check and returns the requested record sets to the user, leading to unauthorized information disclosure.\nPost-exploitation, an attacker can enumerate the database schema, perform data exfiltration of protected records, or gain deeper insights into the underlying storage structure, thereby violating the principle of least privilege.\nThe scope of impact is broad, as it affects multiple release branches, including 2.0.x, 2.1.x, 3.0.x, and specific sub-versions of 4.0.x and 4.1.x. The flaw highlights a logic gap where the application fails to enforce security constraints for authenticated sessions consistently."
}