EUVD-2026-66385Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable FE requires only a valid login (PR:L); no confidentiality loss; high integrity impact from permanent view deletion; low availability from disrupted queries.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.
AnalysisAI
Missing authorization on DROP MATERIALIZED VIEW in StarRocks allows any authenticated account to permanently delete legacy synchronous materialized views across all databases, regardless of grants. The flaw exists because AuthorizerStmtVisitor.visitDropMaterializedViewStatement exits early without invoking the Authorizer; the authorization branch executes only when the resolved object is a modern MaterializedView, not when it is a legacy synchronous view stored as a rollup index on an OlapTable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authentication is required - any valid StarRocks account qualifies (PR:L), with no specific role, grant on the target database, grant on the base table, or grant on the view needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 accurately reflects a meaningful but bounded risk: the attack is network-reachable (AV:N), low-complexity (AC:L), requires only a valid login (PR:L), and produces high integrity impact (VI:H) through permanent view deletion, with low availability impact (VA:L) from disrupted query plans. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated StarRocks analyst account with no grants on a target database issues a `DROP MATERIALIZED VIEW dbname.mv_name` statement naming a known or enumerated legacy synchronous materialized view. The FE routes the statement through `AuthorizerStmtVisitor`, which exits immediately without an authorization call for legacy views, and `AlterJobMgr` completes the drop - permanently removing the rollup index and invalidating downstream query plans - with no audit distinction from an authorized drop. … |
| Remediation | No vendor-released patched version has been independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all database user accounts and revoke unnecessary authentication credentials for non-administrative staff. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today