CVE-2026-80346

Name of the Vulnerable Software and Affected Versions StarRocks (affected versions not specified)

Description An issue exists where the system fails to perform privilege checks when dropping a legacy synchronous materialized view. While most statements routed through AuthorizerStmtVisitor are validated by the Authorizer before execution, the visitDropMaterializedViewStatement function returns immediately. For legacy synchronous materialized views, which are stored as rollup indices on an OlapTable rather than as a MaterializedView, the execution flow reaches AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which invokes the Authorizer. Consequently, any authenticated account can drop a legacy synchronous materialized view in any database, regardless of whether they hold grants on the view, the base table, or the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.