Description
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.
Published: 2026-08-26
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

StarRocks releases 4.0.13 and earlier skip the authorization check when a legacy synchronous materialized view is dropped. Unlike other drop statements that invoke the Authorizer, the DROP MATERIALIZED VIEW path for legacy views bypasses any privilege verification, allowing the operation to succeed regardless of grants on the view, the underlying table, or the database.

Affected Systems

The vulnerability affects the StarRocks database system, specifically versions up to and including 4.0.13. Any instance running a legacy synchronous materialized view—identified as a rollup index on an OlapTable rather than a dedicated MaterializedView object—has the authority bug. Users must be authenticated to the StarRocks service; no special role is required to exploit the flaw.

Risk and Exploitability

With a CVSS score of 7.1, the flaw provides moderate to high severity. The EPSS score is not available, but the scanning logic in the code means that any legacy synchronous materialized view in a database can be dropped by an authenticated user. Although the vulnerability is not listed in CISA’s KEV catalog, its potential to disrupt analytical workloads warrants urgent attention.

Generated by OpenCVE AI on August 26, 2026 at 11:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patched StarRocks release that restores authorization checks for DROP MATERIALIZED VIEW of legacy synchronous materialized views
  • If upgrading is delayed, reconfigure the database to disable legacy synchronous materialized views or convert them to asynchronous views so that the existing authorization logic is enforced
  • Add an additional application‑level permission layer that allows DROP MATERIALIZED VIEW statements only for privileged roles, and disable them for ordinary users
  • Configure auditing and alerting to detect any unexpected DROP MATERIALIZED VIEW commands and investigate promptly

Generated by OpenCVE AI on August 26, 2026 at 11:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Description StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.
Title StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-26T10:09:47.301Z

Reserved: 2026-08-26T09:56:49.238Z

Link: CVE-2026-80346

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T12:00:05Z

Weaknesses