CVE-2026-72524: Apache Software Foundation Apache Doris

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Affected products

• Apache Software Foundation Apache Doris: from 3.1.0, before 3.2 (fixed in 3.2); from 4.0.0, up to and including 4.0.7; from 4.1.0, up to and including 4.1.3

Published 2026-09-14. Last modified 2026-09-14.