UBUNTU-CVE-2026-119377: SQL Injection
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3setauthorizer() SQLITEREAD restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.54.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using SQLite's sqlite3_set_authorizer() with SQLITE_READ restrictions are exposed if an attacker can submit SQL queries to the application. The bypass specifically involves shared USING columns in RIGHT or FULL JOIN queries.
What does an attacker need to exploit it?
The attacker needs the ability to submit SQL and must have at least low-level privileges. Exploitation also requires crafting a RIGHT or FULL JOIN that references a shared USING column whose access would otherwise be denied by the authorizer.
What is the impact of successful exploitation?
An attacker may read columns that the application's SQLite authorizer configuration is intended to deny. The provided severity vector indicates low confidentiality impact, with no integrity or availability impact.
How can I determine whether my application is affected?
Check whether it uses SQLite before 3.54.0 and configures sqlite3_set_authorizer() to restrict SQLITE_READ access. Then identify whether untrusted users can issue SQL that includes RIGHT or FULL JOIN operations with USING clauses.