Missing Authorization in PostgreSQL - CVE-2026-116303
Published: November 12, 2026
Vulnerability identifier: #VU166132
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116303
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass EXECUTE privilege checks on cast functions and potentially disclose sensitive information.
The vulnerability exists due to missing authorization in PostgreSQL type conversion when performing conversions through foreign keys, to_json(), and other operations. A remote user can invoke a cast function without the required EXECUTE privilege to disclose sensitive information if that function's implementation exposes confidential data.
Affected software
PostgreSQL
How to mitigate CVE-2026-116303
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7