CVE-2026-80346
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. The lack of authorization in the drop process allows any authenticated account to drop a view belonging to any database.
Risk Assessment
Unauthorized dropping of materialized views can lead to data loss or disruption of applications, and compromise data integrity.
Recommendation
Update StarRocks to a version where privilege checks for dropping materialized views are fixed, or apply available security patches.
Other vulnerabilities in StarRocks
See all- CVE-2026-82306Medium
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.
- CVE-2026-82276Medium
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.
Original NVD description (English source)
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.