An incorrect authorization vulnerability exists in the single-stage query engine of Apache Pinot versions through 1.5.1. When broker access control is enabled, the engine authorizes only the table named in the query's FROM clause, but not dimension tables referenced via the lookup() transform function. This allows an authenticated user authorized for at least one table to access columns and arbitrary rows from any dimension table without proper authorization or row-level security filters. The multi-stage query engine is not affected. The issue is fixed in Apache Pinot version 1.6.0.