---
id: CVE-2026-80346
title: >-
  StarRocks performs no privilege check when a legacy synchronous materialized
  view is dropped
summary: >-
  StarRocks performs no privilege check when a legacy synchronous materialized
  view is dropped. Every other statement type routed through
  AuthorizerStmtVisitor calls into Authorizer before execution, but
  visitDropMaterializedViewStatement …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-862
published: '2026-08-26'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:43.060'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80346'
references:
  - url: 'https://github.com/StarRocks/starrocks'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/StarRocks/starrocks/blob/3.5.19/fe/fe-core/src/main/java/com/starrocks/alter/AlterJobMgr.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/StarRocks/starrocks/blob/3.5.19/fe/fe-core/src/main/java/com/starrocks/sql/analyzer/AuthorizerStmtVisitor.java
    label: disclosure@vulncheck.com
  - url: 'https://github.com/StarRocks/starrocks/issues/76566'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/starrocks-through-4.0.13-missing-authorization-on-drop-materialized-view-for-legacy-synchronous-materialized-views
    label: disclosure@vulncheck.com
  - url: 'https://github.com/StarRocks/starrocks/issues/76566'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00386
epssPercentile: 0.32607
ingestedAt: '2026-08-29T21:42:34.480Z'
---

## Overview

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.