AZL-113762: CVE-2026-120146 affecting package postgresql 16.15-1
Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16
Event History
Frequently Asked Questions
What privileges does an attacker need to exploit this issue?
The attacker needs a role that has been granted INHERIT on another role but has not been granted SET for that role. Under those conditions, the attacker can use REASSIGN OWNED to transfer objects to the granted role.
Can this affect database ownership as well as ordinary objects?
Yes. The issue can permit reassignment of database ownership without the CREATEDB privilege, even though the equivalent ALTER ... OWNER commands reject those operations.
Which PostgreSQL releases contain the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier releases in those version lines are affected; the listed PostgreSQL 16.15-1 package is affected.