CVE-2026-119377: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3setauthorizer() SQLITEREAD restrictions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SQLite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using SQLite before 3.54.0 are exposed only if they rely on sqlite3_set_authorizer() SQLITE_READ restrictions to prevent reads of particular columns and allow an attacker to submit SQL.

What does an attacker need to exploit the bypass?

The attacker needs the ability to execute or submit a SQL query that uses a RIGHT or FULL JOIN with a shared USING column. The affected column must be one that the application expects SQLITE_READ authorizer restrictions to deny.

Are default SQLite configurations affected?

The bypass concerns authorization policies implemented through sqlite3_set_authorizer() SQLITE_READ restrictions. The provided information does not indicate an impact where that authorization mechanism is not used.

What can be done if upgrading is not immediately possible?

Do not allow untrusted parties to submit SQL, and avoid RIGHT or FULL JOIN queries using shared USING columns where SQLITE_READ authorizer restrictions are relied upon to protect column access.

CVE-2026-119377: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

Are default SQLite configurations affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

Are default SQLite configurations affected?

What can be done if upgrading is not immediately possible?