Starrocks
Monthly
Missing authorization on DROP MATERIALIZED VIEW in StarRocks allows any authenticated account to permanently delete legacy synchronous materialized views across all databases, regardless of grants. The flaw exists because `AuthorizerStmtVisitor.visitDropMaterializedViewStatement` exits early without invoking the Authorizer; the authorization branch executes only when the resolved object is a modern `MaterializedView`, not when it is a legacy synchronous view stored as a rollup index on an `OlapTable`. Versions through 4.0.13 are affected per the VulnCheck advisory, and no public exploit has been identified at time of analysis.
Missing authorization on DROP MATERIALIZED VIEW in StarRocks allows any authenticated account to permanently delete legacy synchronous materialized views across all databases, regardless of grants. The flaw exists because `AuthorizerStmtVisitor.visitDropMaterializedViewStatement` exits early without invoking the Authorizer; the authorization branch executes only when the resolved object is a modern `MaterializedView`, not when it is a legacy synchronous view stored as a rollup index on an `OlapTable`. Versions through 4.0.13 are affected per the VulnCheck advisory, and no public exploit has been identified at time of analysis.