CVE-2026-72524

8.8 Élevée

Publiée le 14/09/2026 à 12:17 · Modifiée le 14/09/2026 à 22:58 · Analyse NVD reportée · Source : security@apache.org

Description

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Doris

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-863

Références

https://lists.apache.org/thread/sxlno9bngg3gk59rxqq7yfqm7bfyj3ph
http://www.openwall.com/lists/oss-security/2026/09/14/3

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories