CVE-2026-68570— Apache Doris: Authorization bypass leading to unauthorized data access
Quick assessment
Affected
Apache Software Foundation Apache Doris
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Doris 中的授权错误漏洞允许经过身份验证的用户绕过权限检查，从而访问其未被授权读取的数据，导致信息非授权泄露。 此问题影响 Apache Doris 的以下版本范围： 从 2.0.0 到 2.1. 从 3.0.0 到 3.0. 从 4.0.0 到 4.0.8 之前的版本 从 4.1.0 到 4.1.4 之前的版本 建议用户升级到已修复该问题的版本（4.0.8 或 4.1.4）。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-68570
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Doris: Authorization bypass leading to unauthorized data access
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information.
This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Doris | 2.0.0 ~ 2.1.* | - |
|
II. Public POCs for CVE-2026-68570
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-68570
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-09-14 · 7 CVEs total
| CVE-2026-82232 | Apache Syncope: SQL injection via sort parameter in Task search | |
| CVE-2026-86460 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence | |
| CVE-2026-87779 | Apache Syncope: AES Secret Key disclosure via log output | |
| CVE-2026-87785 | Apache Syncope: JWT subject spoofing | |
| CVE-2026-87802 | Apache Syncope: SRA OAuth2 JWT signature verification bypass | |
| CVE-2026-72524 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr |
IV. Related Vulnerabilities
Same product: Apache Doris
-
CVE-2026-72524
Apache Doris: Authorization bypass allowing a low-privilege -
CVE-2026-58319
Apache Doris: Improper Authentication in Frontend HTTP API -
CVE-2024-48019
Apache Doris: allows admin users to read arbitrary files thr -
CVE-2024-27438
Apache Doris: Downloading arbitrary remote jar files resulti -
CVE-2024-26307
Apache Doris: Possible race condition
Same vendor: Apache Software Foundation
-
CVE-2026-82232
Apache Syncope: SQL injection via sort parameter in Task sea -
CVE-2026-86460
Apache Syncope: Cypher Injection via FIQL Search on Neo4j Pe -
CVE-2026-87779
Apache Syncope: AES Secret Key disclosure via log output -
CVE-2026-87785
Apache Syncope: JWT subject spoofing -
CVE-2026-87802
Apache Syncope: SRA OAuth2 JWT signature verification bypass
Same weakness: CWE-863
V. Comments for CVE-2026-68570
No comments yet