Apache Kvrocks has a flaw where the APPLYBATCH command can be used even by users lacking sufficient permissions. This allows the attacker to insert, modify, or delete multiple key‑value pairs without authorization, potentially compromising data confidentiality and integrity. The weakness is a permission‑handling issue under CWE‑280.

Apache Kvrocks version 2.8.0 is affected. The vendor recommends upgrading to version 2.16.0 to resolve the issue.

The CVSS score of 9.4 indicates a severe vulnerability. Although EPSS data is not available and the flaw is not listed in CISA’s KEV catalog, the risk remains high. The likely attack vector is a remote attacker who can authenticate to the Kvrocks instance or exploit the command via the network. If the attacker gains any access, this flaw can be used to elevate privileges and corrupt data.