StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. (CVE-2026-80346)

StarRocks fails to perform privilege checks when dropping legacy synchronous materialized views. While other statement types routed through AuthorizerStmtVisitor invoke authorization checks, visitDropMaterializedViewStatement returns immediately, relying on execution logic for checks. This logic applies only to asynchronous materialized views stored as MaterializedView objects. Legacy synchronous materialized views are stored as rollup indexes on OlapTables, causing the drop operation to bypass authorization calls. As a result, any authenticated user can drop these views without proper permissions, and the drop operation appears authorized.

An attacker with any authenticated account can drop legacy synchronous materialized views in any database without holding the required privileges on the view, base table, or database. This can lead to unauthorized disruption of database objects and potential denial of service or data availability issues. The vulnerability does not disclose data or allow privilege escalation beyond dropping the views.

No patch or official fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted users only and monitor for suspicious drop operations on materialized views.