Authorization Flaw in StarRocks Affects Legacy Synchronous Materialized Views

CVE-2026-80346

What is CVE-2026-80346?

The vulnerability in StarRocks arises from the absence of a privilege check when dropping legacy synchronous materialized views. Unlike other commands that engage the Authorization mechanism, the process for these legacy views bypasses necessary checks, allowing any authenticated user to remove views without proper permissions. This oversight is particularly concerning as the drop operation cannot be distinguished from an authorized action, thereby introducing significant security risks to database integrity.

References