| From: | Noah Misch <noah(at)leadboat(dot)com> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O |
| Date: | 2026-08-10 13:41:21 |
| Message-ID: | E1wtQFl-00000000y22-076v@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
Check for USAGE privilege on the composite type in ALTER TABLE OF.
This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.
Reported-by: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Author: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Reviewed-by: Robert Haas <robertmhaas(at)gmail(dot)com>
Security: CVE-2026-6470
Backpatch-through: 14
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/53ed5ebd84fb24cae5bc6cc5a6d75edcecc9884b
Author: Nathan Bossart <nathan(at)postgresql(dot)org>
Modified Files
--------------
src/backend/commands/tablecmds.c | 5 +++++
src/test/regress/expected/privileges.out | 6 ++++++
src/test/regress/sql/privileges.sql | 5 +++++
3 files changed, 16 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Noah Misch | 2026-08-10 13:41:22 | pgsql: Return nulls honestly in aggregate "combine" functions. |
| Previous Message | Noah Misch | 2026-08-10 13:41:20 | pgsql: Fix pg_trgm's picksplit function with all-true datums |