Missing Authorization in PostgreSQL - CVE-2026-120146
Published: November 12, 2026
Vulnerability identifier: #VU166095
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120146
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authorization restrictions on object and database ownership transfers.
The vulnerability exists due to missing authorization checks in the PostgreSQL core server's REASSIGN OWNED command when processing ownership reassignment requests. A remote user can execute REASSIGN OWNED to transfer objects to a role granted with INHERIT but not SET, or reassign database ownership without the CREATEDB privilege, to bypass ownership transfer restrictions.
Affected software
PostgreSQL
How to mitigate CVE-2026-120146
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7