Description

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T10:17:04.573Z",
  "pubdate": "2026-09-14T10:17:04.573Z",
  "executiveSummary": "Apache Doris is susceptible to an Incorrect Authorization vulnerability that permits authenticated users to circumvent established privilege controls. This security flaw allows malicious actors with valid account credentials to access, view, or modify sensitive data beyond their designated authorization scope.\nThe vulnerability affects multiple releases, specifically Apache Doris versions 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3.\nThe risk implication is critical, as it undermines the integrity of the Role-Based Access Control (RBAC) model implemented within the database system. An attacker capable of exploiting this flaw does not require escalated administrative privileges initially; they merely need an authenticated session to leverage the authorization check bypass.\nThe flaw exposes the system to unauthorized data exfiltration, illicit data manipulation, and potential system compromise. Organizations utilizing affected versions are at significant risk of unauthorized internal data access. Remediation requires an immediate upgrade to the patched versions provided by the vendor to restore robust access control enforcement.",
  "technicalDetails": "The vulnerability stems from a flaw in the authorization logic component of Apache Doris, which fails to correctly validate user permissions during certain data operations. In a standard secure implementation, the system should intercept requests and perform a check against the user's assigned roles and privileges before executing any query or modification command. In the affected versions, this verification step is bypassed, resulting in an Incorrect Authorization state.\nThe root cause lies within the internal privilege checking mechanism where the authorization module may improperly evaluate the security context of an incoming request. When an authenticated user submits a request for a data object or administrative action that they are not explicitly authorized to perform, the system fails to block the operation. Instead, the application logic assumes the user has the necessary permissions based on faulty internal state tracking or incomplete validation checks.\nThe attack flow proceeds as follows: First, the attacker must possess a valid authenticated session within the target Apache Doris cluster. Upon gaining access, the attacker identifies specific resources—such as databases, tables, or sensitive rows—that are protected by standard RBAC policies. The attacker then crafts specific queries or API calls that target these restricted resources. Because the system's authorization enforcement layer is flawed, it incorrectly treats these requests as permitted operations. Consequently, the backend service proceeds to process the unauthorized request, resulting in the leakage of protected data or the unauthorized execution of data manipulation commands.\nThis vulnerability is particularly dangerous because it does not require complex exploit chains or memory corruption techniques. It is a logical bypass that directly violates the principle of least privilege. The impact is significant as it affects the confidentiality and integrity of the database. Post-exploitation, an attacker could potentially gain unauthorized insights into the database schema, extract sensitive information, or perform destructive operations that could disrupt business continuity. Because the vulnerability resides in the core authorization logic, all administrative and user interfaces that rely on this shared component are potentially susceptible when exposed to authenticated traffic."
}