CVE-2026-68570 in Doris
Summary
by MITRE • 09/14/2026
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information.
This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Apache Doris represents a critical failure in access control mechanisms, specifically categorized under CWE-269: Improper Privilege Management. This flaw allows an authenticated user to bypass standard privilege checks, thereby gaining unauthorized access to data resources that should be restricted based on their assigned roles or permissions. In the context of distributed SQL databases like Apache Doris, which are often used for real-time analytics and large-scale data processing, such a breach undermines the fundamental security model of multi-tenancy and role-based access control. The attacker does not require elevated system privileges to exploit this issue; rather, they leverage existing authentication credentials combined with specific query patterns or metadata interactions that trigger the authorization logic flaw. This results in an unauthorized disclosure of sensitive information, potentially exposing proprietary business data, personally identifiable information, or other confidential records stored within the database clusters affected by this defect.
The technical root cause lies in how Apache Doris processes and validates access requests against its internal permission tables during query execution. When a user submits a query to read from a table, partition, or column, the system is supposed to verify that the user possesses the necessary SELECT privileges for those specific objects. However, due to incorrect authorization logic, certain paths of request processing fail to enforce these checks correctly. This could involve edge cases in how metadata locks are handled, how role inheritance is evaluated, or how dynamic table names are resolved against static permission records. Consequently, a malicious actor can craft requests that slip past the security gatekeepers, effectively treating restricted data as public or accessible within their own scope. The impact extends beyond simple data leakage; it compromises the integrity of audit logs and trust in the database's ability to enforce compliance requirements such as GDPR, HIPAA, or SOC2, which mandate strict access controls over sensitive datasets.
This vulnerability affects multiple versions of Apache Doris, indicating a systemic issue that persisted across significant development cycles before being addressed. Specifically, it impacts version ranges from 2.0.0 through 2.1., from 3.0.0 through 3.0., and critically, the more recent releases from 4.0.0 up to but not including 4.0.8, as well as versions from 4.1.0 up to but not including 4.1.4. The presence of this flaw in newer major version lines suggests that regression testing or automated security validation may have missed specific authorization edge cases during feature development. Organizations running these affected versions are at immediate risk if their databases are exposed to internal users with varying levels of trust, particularly in environments where data segregation between different departments or tenants is enforced solely through database-level permissions rather than network isolation.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Initial Access and Collection phases, specifically leveraging valid accounts (T1078) to exfiltrate data without triggering typical intrusion detection alerts that look for brute-force or credential stuffing attacks. Since the attacker is already authenticated, traditional perimeter defenses may not flag their activity as malicious, making internal monitoring and strict database auditing essential mitigations until an upgrade can be performed. The operational impact includes potential regulatory fines, reputational damage, and loss of customer trust due to data breaches stemming from this logical flaw rather than a technical exploit like buffer overflow or injection.
To mitigate this risk, immediate action is required for all organizations running the affected versions. Users must upgrade Apache Doris to version 4.0.8 or later if they are on the 4.0 branch, or to version 4.1.4 or later if they are on the 4.1 branch. These fixed releases contain patches that correct the authorization logic, ensuring that privilege checks are consistently applied regardless of how queries are structured or which metadata paths are traversed. In addition to upgrading, administrators should review their current user permissions and apply the principle of least privilege, ensuring that users only have access to the specific tables and columns necessary for their roles. Implementing comprehensive audit logging for all data retrieval operations can also help detect any potential exploitation attempts during the window between vulnerability discovery and patch deployment. Regular security assessments and penetration testing focused on authorization bypasses are recommended to validate the effectiveness of these controls in production environments.