CVE-2026-80346

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.

• CWE-862

• https://github.com/StarRocks/starrocks
• https://github.com/StarRocks/starrocks/blob/3.5.19/fe/fe-core/src/main/java/com/starrocks/alter/AlterJobMgr.java
• https://github.com/StarRocks/starrocks/blob/3.5.19/fe/fe-core/src/main/java/com/starrocks/sql/analyzer/AuthorizerStmtVisitor.java
• https://github.com/StarRocks/starrocks/issues/76566
• https://www.vulncheck.com/advisories/starrocks-through-4.0.13-missing-authorization-on-drop-materialized-view-for-legacy-synchronous-materialized-views
• https://github.com/StarRocks/starrocks/issues/76566

Published

Aug 26, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8034A server-side request forgery (SSRF) vulnerability was ident…9.8
• CVE-2026-80340The Payment Plugins for PayPal WooCommerce WordPress plugin …5.3
• CVE-2026-80341The Payment Plugins for PayPal WooCommerce WordPress plugin …5.9
• CVE-2026-80342The Payment Plugins for PayPal WooCommerce WordPress plugin …6.5
• CVE-2026-80343Improper Handling of Case Sensitivity vulnerability in Apach…8.2
• CVE-2026-80344Server-Side Request Forgery (SSRF) vulnerability in Apache C…8.2
• CVE-2026-80347mcp-fetch checks a fetch target against its SSRF guard witho…7.5
• CVE-2026-80348TarsWeb enforces its per-application roles by calling AuthSe…8.8
• CVE-2026-80349TarsWeb decides whether a request comes from a trusted local…9.8
• CVE-2026-8035Improper input validation in the NI-PAL kernel driver may al…5.5
• CVE-2026-80350OneUptime's webhook target check rejects private and loopbac…7.1
• CVE-2026-80351Improper neutralization of directives in dynamically evaluat…9.8