Incorrect authorization in PostgreSQL - CVE-2026-16237
Published: November 12, 2026
Vulnerability identifier: #VU166135
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-16237
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read and modify rows in a view's base table that should be excluded by the view's WHERE condition.
The vulnerability exists due to improper authorization in PostgreSQL's handling of INSERT ... ON CONFLICT on auto-updatable views when processing conflicting inserts. A remote user can issue repeated INSERT ... ON CONFLICT DO UPDATE statements with INSERT and UPDATE privileges on the view to bypass its WHERE condition and read and modify every row in the underlying base table.
The bypass applies whether or not the view is a security_barrier view.
Affected software
PostgreSQL
How to mitigate CVE-2026-16237
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7