IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-11-05 10:15

MODIFIED

2025-11-05 10:15

EPSS (Prob. Exploit)

0.37%

Top 70.0%

DATA SOURCES:

NVD 🔗 2025-11-05 CVE PROJECT 🔗 2026-01-19 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications. Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-284

> CWE DETAILED DESCRIPTIONS

CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

> GITHUB SECURITY ADVISORY

GHSA-m35w-xx8c-6xc7 MODERATE

Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode

AFFECTED PACKAGES:

PIP / doris-mcp-server

< 0.6.0

Fixed in: 0.6.0

> HISTORIQUE DES MODIFICATIONS

Première apparition

05/11/2025 10:15

Source: NVD

📊 ENRICHISSEMENT 19/01/2026 17:36

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui

📊 ENRICHISSEMENT 01/12/2025 06:01

CWE

Champ modifié: Description CWE