The vulnerability is an incorrect authorization check that lets an authenticated user bypass privilege verification and perform any DML or DDL operation on tables in Apache Doris. This permits reading, writing, or dropping arbitrary tables, compromising data confidentiality, integrity, and availability. The weakness corresponds to CWE-863.

Affected software is Apache Doris developed by the Apache Software Foundation. Versions 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3 are vulnerable.

The flaw can be exploited by any authenticated user; no additional privileges are needed, making it possible for low‑privilege accounts to gain full control over database objects. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog, but the high CVSS score of 8.8 and the impact of privilege escalation suggest a high risk. Attackers would need authenticated access, likely through the application or client connections, to issue privileged queries and bypass checks.